{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64678", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-20T17:12:12.892Z", "datePublished": "2026-11-11T04:07:12.719Z", "dateUpdated": "2026-11-11T04:07:12.719Z"}, "containers": {"cna": {"title": "Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg"}, {"name": "https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1"}], "affected": [{"vendor": "nitrite", "product": "nitrite-java", "versions": [{"version": "< 4.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T04:07:12.719Z"}, "descriptions": [{"lang": "en", "value": "NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() \u2014 solely to remap a handful of known legacy class names to their current equivalents \u2014 and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1."}], "source": {"advisory": "GHSA-9297-g93h-86gg", "discovery": "UNKNOWN"}}}}

{}

{}

{}

{}