PT-2025-23052 · Apache · Apache Inlong

H3H3Qaq + 1 · Published 2025-05-28 · Updated 2025-05-28 · CVE-2025-27526

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.13.0 through 2.1.0

Description The issue is related to the deserialization of untrusted data in Apache InLong, which can lead to the bypass of JDBC URL encoding and backspace. This can potentially cause security problems.

Recommendations For Apache InLong versions 1.13.0 through 2.1.0, update to version 2.2.0 to resolve the issue. Alternatively, cherry-pick the solution from the provided GitHub pull request to solve it.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-06617

CVE-2025-27526

GHSA-532X-J9R7-8F73

Affected Products

Apache Inlong

References · 14

• https://github.com/apache/inlong/pull/11747 · Patch
• https://osv.dev/vulnerability/CVE-2025-27526 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-532x-j9r7-8f73 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06617 · Security Note
• https://lists.apache.org/thread/4t4sqscm7xdqn883dyjy40qk6ncf26xf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27526 · Security Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/commit/48c2f5cad4a92be2c3561174d70cdbc91a2d2626 · Note
• http://openwall.com/lists/oss-security/2025/05/28/1 · Note
• https://t.me/cvetracker/24803 · Telegram Post
• https://t.me/cvenotify/123805 · Telegram Post
• https://twitter.com/oss_security/status/1927569123740967381 · Twitter Post
• https://twitter.com/CVEnew/status/1927648256839876814 · Twitter Post
• https://openwall.com/lists/oss-security/2025/05/28/1 · Note