Is CVE-2025-13805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13805 being exploited in the wild.

How severe is CVE-2025-13805?

Low severity, with a CVSS score of 3.7, published 1 December 2025.

Which products and versions are affected?

org.nutz:nutzboot-parent (Maven) ECOSYSTEM:introduced=0,last_affected=2.6.0-SNAPSHOT.

Is there a fix for CVE-2025-13805?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13805 attacked?

It is attacked over the network.

Am I affected by CVE-2025-13805?

Check whether you run org.nutz:nutzboot-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13805: Nutz NutzBoot LiteRpc Java deserialization remote code execution

CVE-2025-13805 · Severity: low · CVSS 3.7 · Published 2025-12-01

NutzBoot is a Java application framework that includes a lightweight RPC component (LiteRpc) for network communication. An unauthenticated attacker can send specially crafted serialized Java objects to the HTTP endpoint without credentials, triggering unsafe deserialization that leads to remote code execution on the server, allowing an attacker to execute arbitrary commands with the application's privileges.

Technologies: org.nutz:nutzboot-parent (Maven). Vendors: Maven.

Quick answers

Is CVE-2025-13805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13805 being exploited in the wild.
How severe is CVE-2025-13805?: Low severity, with a CVSS score of 3.7, published 1 December 2025.
Which products and versions are affected?: org.nutz:nutzboot-parent (Maven) ECOSYSTEM:introduced=0,last_affected=2.6.0-SNAPSHOT.
Is there a fix for CVE-2025-13805?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13805 attacked?: It is attacked over the network.
Am I affected by CVE-2025-13805?: Check whether you run org.nutz:nutzboot-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the getInputStream function of the HttpServletRpcEndpoint component within NutzBoot's LiteRpc module (org.nutz.boot.starter.literpc.impl.endpoint.http.HttpServletRpcEndpoint.java). The flaw is an unsafe Java deserialization issue where untrusted serialized objects are deserialized without proper validation. An unauthenticated attacker can exploit this by sending malicious serialized payloads over the network to the HTTP RPC endpoint, achieving remote code execution. The attack has high complexity but is characterized as difficult to exploit, though public exploits are available. Patches and fixed versions should be checked with the Nutz Framework maintainers.

Affected products

Nutz Framework NutzBoot up to 2.6.0-SNAPSHOT

Identifiers

CVE-2025-13805
GHSA-fgmj-6h3v-4q56

Timeline

2025-12-01: disclosed
other: Public exploit available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.