CVE-2026-64678— Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path

Quick assessment

Affected

nitrite nitrite-java

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NOsql Object（简称 NO2，又名 Nitrite）数据库是一个开源的嵌入式 NoSQL 文档存储系统。在 4.4.1 版本之前，当 Nitrite 打开数据库文件时，方法会自动检测是否存在旧版 v1 格式的存储；一旦检测到旧格式或在打开过程中遇到兼容性错误，便会触发自动迁移流程。该迁移路径通过方法反序列化已存储的值，该方法将原始字节流直接传递给，并经由自定义的子类进行处理。该子类仅重写了方法，用于将少量已知的旧版类名映射到当前等效类名，但并未实现任何类白名单、黑名单或（JEP 290）机制

CVSS 9.8 · Critical Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path

Source: CVE Program / CVE List V5

Vulnerability Description

NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nitrite	nitrite-java	< 4.4.1	-

II. Public POCs for CVE-2026-64678

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-64678

请登录查看更多情报信息。

Other References for CVE-2026-64678 (2)

https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1 x_refsource_MISC
https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-64678

IV. Related Vulnerabilities

Same weakness: CWE-502