# CVE-2025-13805: Nutz NutzBoot LiteRpc Java deserialization remote code execution

Source: https://junglewise.ai/threats/cve-2025-13805-nutz-nutzboot-literpc-java-deserialization-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13805 · Severity: low · CVSS 3.7 · Published 2025-12-01

NutzBoot is a Java application framework that includes a lightweight RPC component (LiteRpc) for network communication. An unauthenticated attacker can send specially crafted serialized Java objects to the HTTP endpoint without credentials, triggering unsafe deserialization that leads to remote code execution on the server, allowing an attacker to execute arbitrary commands with the application's privileges.

Technologies: [org.nutz:nutzboot-parent (Maven)](https://junglewise.ai/threats/technologies/org-nutz-nutzboot-parent). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-13805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13805 being exploited in the wild.

**How severe is CVE-2025-13805?** Low severity, with a CVSS score of 3.7, published 1 December 2025.

**Which products and versions are affected?** org.nutz:nutzboot-parent (Maven) ECOSYSTEM:introduced=0,last_affected=2.6.0-SNAPSHOT.

**Is there a fix for CVE-2025-13805?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13805 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-13805?** Check whether you run org.nutz:nutzboot-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the getInputStream function of the HttpServletRpcEndpoint component within NutzBoot's LiteRpc module (org.nutz.boot.starter.literpc.impl.endpoint.http.HttpServletRpcEndpoint.java). The flaw is an unsafe Java deserialization issue where untrusted serialized objects are deserialized without proper validation. An unauthenticated attacker can exploit this by sending malicious serialized payloads over the network to the HTTP RPC endpoint, achieving remote code execution. The attack has high complexity but is characterized as difficult to exploit, though public exploits are available. Patches and fixed versions should be checked with the Nutz Framework maintainers.

## Affected products

- Nutz Framework NutzBoot up to 2.6.0-SNAPSHOT

## Identifiers

- CVE-2025-13805
- GHSA-fgmj-6h3v-4q56

## Timeline

- 2025-12-01: disclosed
- other: Public exploit available

## References

- [https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-RCE-1/report.md](https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-RCE-1/report.md)
- [https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-RCE-1/report.md](https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-RCE-1/report.md)

## Related threats

- [NutzBoot Incorrect Privilege Assignment vulnerability](https://junglewise.ai/threats/cve-2025-13806-a-security-vulnerability-has-been-detected-in-nutzam-nutzboot-up)
- [Nutz NutzBoot information disclosure in Ethereum Wallet Handler](https://junglewise.ai/threats/cve-2025-13804-nutz-nutzboot-information-disclosure-in-ethereum-wallet-handler)