GHSA-fgmj-6h3v-4q56

Source

https://github.com/advisories/GHSA-fgmj-6h3v-4q56

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-fgmj-6h3v-4q56/GHSA-fgmj-6h3v-4q56.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fgmj-6h3v-4q56

Aliases

CVE-2025-13805

Published

2025-12-01T06:30:25Z

Modified

2025-12-02T01:30:38.076886Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

NutzBoot vulnerable to deserialization

Details

A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be exploited.

Database specific

{
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20"
    ],
    "nvd_published_at": "2025-12-01T04:16:05Z",
    "github_reviewed_at": "2025-12-02T00:32:08Z"
}

References

Affected packages

Maven / org.nutz:nutzboot-parent

Package

Name: org.nutz:nutzboot-parent; View open source insights on deps.dev
Purl: pkg:maven/org.nutz/nutzboot-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.6.0-SNAPSHOT

Affected versions

2.*

2.0-Beta

2.0

2.0.1

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.3.0.v20190220

2.3.1.v20190318

2.3.3.v20190329

2.3.4.v20190410

2.3.5.v20190516

2.3.6.v20190621

2.3.7.v20190731

2.3.8.v20191031

2.3.9.v20200309

2.4.0.v20200427

2.4.1.v20201014

2.4.2.v20201205

2.5.1.v20220215