Remote Code Execution Vulnerability in Nitrite Database by Nitrite
CVE-2026-64678

9.8CRITICAL

Key Information:

Vendor

Nitrite

Status
Nitrite-java
Vendor
CVE Published:
11 November 2026

What is CVE-2026-64678?

The Nitrite Database, an open-source embedded document store, possesses a vulnerability that could allow remote code execution. When opening a database file prior to version 4.4.1, a built-in automatic migration process improperly deserializes raw byte data using Java's ObjectInputStream. This oversight means that any Serializable class from the application’s classpath could be instantiated, creating a significant security risk. Without an effective allowlist or filter, the presence of a 'gadget class' in the classpath could facilitate remote code execution through maliciously crafted inputs. This flaw has been addressed and patched in version 4.4.1.

Affected Version(s)

nitrite-java < 4.4.1

References

https://github.com/nitrite/nitrite-java/security/advisori...
x_refsource_CONFIRM
https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.