CVE-2026-64678

NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1.

• CWE-502

• https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1
• https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64669pam_usb provides hardware authentication for Linux using rem…7.4
• CVE-2026-64670Waline is a comment system with backend support. In versions…9.3
• CVE-2026-64671Waline is a comment system with backend support. In versions…7.2
• CVE-2026-64672Terragrunt is a flexible orchestration tool that allows Infr…4.4
• CVE-2026-64676Kata Containers is an open source implementation of lightwei…5.7
• CVE-2026-64677Anki is a program for creating and reviewing flashcards. Pri…5.9
• CVE-2026-64679Atlantis is a self-hosted golang application that listens fo…8.1
• CVE-2026-64682AstroBlocks is a block-first CMS for Astro projects. Prior t…9.8
• CVE-2026-64684RMCP is an official Rust SDK for the Model Context Protocol.…6.8
• CVE-2026-64685ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-64686OpenSearch Dashboards is an open-source data visualization t…5
• CVE-2026-6469Incorrect ownership assignment in PostgreSQL ALTER TABLE ALT…3.8