CVE-2025-27522: Apache InLong: JDBC Vulnerability during verification processing

May 28, 2025 (updated October 31, 2025)

Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong’s 2.2.0 or cherry-pick [1] to solve it.

[1]

https://github.com/apache/inlong/pull/11732

References

github.com/advisories/GHSA-r324-vgr5-73c9
github.com/apache/inlong
github.com/apache/inlong/commit/86c893cfd8f7ba9ffce5d20abef6cd360f502fdf
github.com/apache/inlong/pull/11732
lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby
nvd.nist.gov/vuln/detail/CVE-2025-27522

Code Behaviors & Features

Detect and mitigate CVE-2025-27522 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →