cve.nowby Sazabi

MavenPackage

org.apache.causeway.commons:causeway-commons

1 known vulnerability (1 medium), with the versions each affects and the releases that fix them.

Latest release: 3.6.0 (Apr 5, 2026): no advisory affects it
Newest unaffected release: 3.6.0 (Apr 5, 2026), the latest release
Advisories: 1 · 1 medium

Dependents: 109
Releases: 15 since 2.0.0 (Mar 22, 2024)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-64408
Affects 2.0.0-RC1 to 3.4.0 (3.5.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

CVE-2025-64408Medium 6.3
Apache Causeway: Java deserialization vulnerability to authenticated attackers
Affected: fixed in 3.5.0.
Fixed in 3.5.0 (released Nov 12, 2025, 7 days before disclosure).
The latest release, 3.6.0, is not affected.