CVE-2025-64428 is a critical (CVSS 9.8) JNDI injection in DataEase. The blacklist added in 2.10.14 did not cover the iiop, corbaname and iiopname schemes, so the problem remained. Versions before 2.10.17 are affected, and 2.10.17 contains the fix, so plan an upgrade now.
What's affected
The NVD record says versions prior to 2.10.17 are vulnerable, and that the vulnerability is fixed in 2.10.17. It describes a blacklist added in the patch for 2.10.14, and says injection stayed possible through the iiop, corbaname and iiopname schemes.
In practice that means installs on 2.10.14, 2.10.15 and 2.10.16 are not safe, even though earlier advisories told you to move to those versions. Upgrade to 2.10.17 or later. The record references the fix commit, the v2.10.17 release and advisory GHSA-88ph-3236-2m2h. We could not retrieve the advisory body.
How to check if you're exposed
Check which DataEase release you run:
docker ps --format '{{.Names}} {{.Image}}'
If the tag is below 2.10.17, you are affected, including the 2.10.14 to 2.10.16 range some teams moved to earlier. Next, check network exposure. The CVSS vector shows network access with no privileges needed, so an internet facing instance deserves urgency. Look at outbound connections from the DataEase host for anything unexpected, and review which people and services can configure data sources.
A dependency scanner can help you track the version across environments. The free in-browser scan at gold.safeguard.sh/scan takes a manifest and flags known vulnerable components.
What to do now
- Upgrade DataEase to 2.10.17 or later.
- If you moved to 2.10.14, 2.10.15 or 2.10.16 for earlier CVEs, move again. Those releases do not contain this fix.
- Restrict access to the instance and limit its egress.
- Review data source definitions and remove ones you do not use.
- Track the DataEase project advisories, since this family of issues has produced several follow ups.
Why it matters
The record lists CWE-74, improper neutralization of special elements in output used by a downstream component, which is the injection family. The cause here is a filter that listed bad schemes instead of allowing good ones. Each time a scheme is found that the list misses, the same flaw reappears under a new name.
For a defender, the pattern has a useful side. When a fix is a blacklist, expect a bypass and watch the advisories. This CVE is the third in a short run for the same product, with CVE-2025-64163 and CVE-2025-64164 before it. The record does not mark it as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I already patched to 2.10.15. Am I done?
No. This CVE says the earlier blacklist was incomplete. The fixed version is 2.10.17.
Which schemes were missed?
The record names iiop, corbaname and iiopname.
Sources
Last reviewed: 18 October 2026.
