What is the CVSS score of CVE-2026-42778?

CVE-2026-42778 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Apache MINA are affected by CVE-2026-42778?

Apache MINA versions 2.1.0-2.1.11 and 2.2.0-2.2.6 contain a critical remote code execution vulnerability exploitable without authentication, confirmed actively exploited (CISA KEV).. A patch is available.

How to fix or mitigate CVE-2026-42778?

Within 24 hours: Inventory all applications and services using Apache MINA 2.1.x or 2.2.x versions; isolate or disable affected systems from untrusted networks if immediately upgradeable versions are unavailable. Within 7 days: Upgrade to Apache MINA 2.1.12 or later (2.1.x series) or 2.2.7 or later (2.2.x series); verify all deserialization code paths, especially IoBuffer.getObject() calls, are updated. Within 30 days: Conduct full application security assessment of MINA integration points; implement network segmentation to restrict MINA service access to trusted sources only; monitor logs for exploitation attempts targeting deserialization endpoints.

Apache MINA CVE-2026-42778

EUVD-2026-26492 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-01 apache

GHSA-995c-6rp3-4m4x

Apache Deserialization Red Hat

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

9.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 10:45 vuln.today

EUVD ID Assigned

May 01, 2026 - 10:30 euvd

EUVD-2026-26492

Analysis Generated

May 01, 2026 - 10:30 vuln.today

CVE Published

May 01, 2026 - 10:01 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

32 maven packages depend on org.apache.mina:mina-core (14 direct, 18 indirect)

Ecosystem-wide dependent count for version 2.1.0.

DescriptionCVE.org

The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.

Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.

The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade

Affected versions are Apache MINA 2.1.0 <= 2.1.110, and 2.2.0 <= 2.2.6.

The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade

AnalysisAI

Remote code execution in Apache MINA 2.1.0-2.1.11 and 2.2.0-2.2.6 allows unauthenticated attackers to execute arbitrary code via unsafe deserialization. The fix for prior CVE-2024-52046 was incomplete-the classname allowlist protecting IoBuffer.getObject() was applied too late, allowing malicious static initializers to execute before filtering. Confirmed actively exploited (CISA KEV). EPSS exploitation probability not provided, but the network-accessible, unauthenticated attack vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) combined with KEV status indicates immediate patching is critical for applications calling IoBuffer.getObject().

Technical ContextAI

Apache MINA is a network application framework for building high-performance, scalable protocol servers and clients over TCP, UDP, and other transports. The vulnerability resides in AbstractIoBuffer.getObject(), which deserializes Java objects from network data streams. CWE-502 (Deserialization of Untrusted Data) is the root cause: when Java objects are deserialized, their static initializers execute immediately during class loading-before any defensive filtering can occur. The incomplete fix from CVE-2024-52046 applied the classname allowlist only after the static initializer had already run, creating a window for arbitrary code execution through gadget chains in static blocks. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_mina for versions 2.1.0-2.1.11 and 2.2.0-2.2.6. This is a regression introduced when the original fix was not backported to these maintenance branches.

RemediationAI

Upgrade immediately to Apache MINA 2.1.12 or 2.2.7, which apply the classname allowlist before static initializers execute, per Apache Security Advisory https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0. If immediate upgrade is not feasible, implement compensating controls with these trade-offs: (1) Remove all calls to IoBuffer.getObject() and replace with safer serialization mechanisms like JSON or Protocol Buffers-eliminates attack surface but requires code changes and testing; (2) Deploy network-level filtering to block access to MINA-based services from untrusted networks-reduces exposure but does not prevent attacks from internal or VPN-connected attackers; (3) Implement strict input validation before any deserialization operations-difficult to implement correctly and may still miss gadget chains. Note that the incomplete fix for CVE-2024-52046 demonstrates the difficulty of securing Java deserialization retroactively. Long-term architectural remediation should eliminate use of Java native serialization for untrusted data.