EUVD-2026-25809
GHSA-f2wh-grmh-r6jm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Blast Radius
ecosystem impact- 8 maven packages depend on org.apache.mina:mina-core (8 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0.
DescriptionCVE.org
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.
The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
AnalysisAI
Remote unauthenticated attackers can execute arbitrary code in Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5 through unsafe deserialization in AbstractIoBuffer.getObject(). This is an incomplete fix bypass for CVE-2024-52046 where the classname allowlist validation occurs after static initializers execute, enabling attackers to trigger malicious code execution before security controls engage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to call IoBuffer.getObject() on attacker-controlled network input - this is NOT a default MINA behavior and must be explicitly implemented in application code. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is CRITICAL for applications exposing IoBuffer.getObject() to network input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a MINA-based network service that processes serialized Java objects via IoBuffer.getObject(). They craft a malicious serialized payload containing a class with a weaponized static initializer (e.g., commons-collections gadget chain). … |
| Remediation | Upgrade immediately to Apache MINA 2.0.28, 2.1.11, or 2.2.6 depending on your deployed branch - vendor-released patches available per Apache advisory at https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Apache MINA versions 2.0.0-2.2.5 and audit which applications call IoBuffer.getObject(). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today