NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store.
NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Nitrite
- Product
- nitrite-java
- CVSS v3.1
- 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Fix
- available
- Weakness
- CWE-502
- NVD status
- Received
Why it ranks 38 (Notable)
- CVSS v3.1 9.8 critical
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-64678 on this site · NVD · CVE.org · Vulnpedia