~ / search / GHSA-fgmj-6h3v-4q56

GHSA-fgmj-6h3v-4q56

NutzBoot vulnerable to deserialization

Source: GitHub Advisory Database (reviewed) Low CVE-2025-13805

Packages

EcosystemPackageAffectedFixed in
Maven org.nutz:nutzboot-parent <= 2.6.0-SNAPSHOT no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be exploited.

References

External links from the advisory. They lead to third-party sites.