IT SBIT Services
Schneeberger
DEEN
CVE tracker

Nitrite Java: Unfiltered Java deserialization in legacy v1 migration path

CVE-2026-64678Critical 9.8

← All vulnerabilities

Summary

Nitrite, an open source embedded NoSQL document store for Java, deserializes values from legacy v1-format database files without any class restriction when it opens such a file. An attacker who can get a crafted file opened by the application, for example via an upload, import or backup restore, can cause arbitrary Serializable classes on the classpath to be instantiated and their callbacks executed. Remote code execution requires a suitable gadget class, such as one from commons-collections, to be present on the classpath.

Affected

  • org.dizitart:nitrite-mvstore-adapter (Nitrite Java) versions before 4.4.1 (advisory lists <= 4.4.0)
  • Applications that embed Nitrite and open database files from untrusted sources are at risk

Fixed in

  • Version 4.4.1: the v1-compat deserializer enforces a JEP 290 allowlist that permits only Nitrite and standard JDK types

Workaround

Unknown. No vendor workaround found.

  • Do not open database files from untrusted sources (uploads, imports, restored backups, synced files)
  • Restrict write access to database file paths
  • Review the classpath for gadget libraries such as commons-collections

Exploitation

  • Not known to be exploited in the wild at the time of research
  • No public proof of concept found at the time of research
  • CISA KEV status: unknown

Our recommendation

  • Find all Java applications that use Nitrite, including shaded JARs and container images
  • Upgrade to 4.4.1 at minimum; 5.x is the safer target if the application can move, because other Nitrite issues are fixed only in 5.x
  • Prioritise applications that import, restore or sync database files
  • Treat the CNA score 9.8 as the planning basis; VulDB scores it 7.3, and the actual risk depends on the application

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:21.

Original description (NVD)

NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed