What is the CVSS score of EUVD-2026-25809?

EUVD-2026-25809 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache MINA are affected by EUVD-2026-25809?

Apache MINA versions 2.0.0-2.2.5 contain a critical remote code execution vulnerability in deserialization logic that allows unauthenticated attackers to execute arbitrary code on affected systems…. A patch is available.

How to fix or mitigate EUVD-2026-25809?

Within 24 hours: Identify all systems running Apache MINA versions 2.0.0-2.2.5 and audit which applications call IoBuffer.getObject(). Within 7 days: Upgrade to patched versions (2.0.28, 2.1.11, or 2.2.6 depending on your branch). Within 30 days: Conduct code review to confirm all unsafe deserialization paths are eliminated and validate patch deployment across all affected instances.

Apache MINA EUVD-2026-25809

| CVE-2026-41409 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-27 apache

GHSA-f2wh-grmh-r6jm

Deserialization Apache Red Hat

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

9.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 10:30 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 10:00 euvd

EUVD-2026-25809

Analysis Generated

Apr 27, 2026 - 10:00 vuln.today

CVE Published

Apr 27, 2026 - 09:20 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 maven packages depend on org.apache.mina:mina-core (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionCVE.org

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.

Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.

The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade

AnalysisAI

Remote unauthenticated attackers can execute arbitrary code in Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5 through unsafe deserialization in AbstractIoBuffer.getObject(). This is an incomplete fix bypass for CVE-2024-52046 where the classname allowlist validation occurs after static initializers execute, enabling attackers to trigger malicious code execution before security controls engage. Apache confirmed the flaw affects applications calling IoBuffer.getObject() and released patches in versions 2.0.28, 2.1.11, and 2.2.6. CVSS 9.8 critical score reflects network-accessible unauthenticated exploitation with complete system compromise potential.

Technical ContextAI

Apache MINA (Multipurpose Infrastructure for Network Applications) is a Java network application framework providing async event-driven I/O capabilities. The vulnerability resides in AbstractIoBuffer.getObject(), which performs Java object deserialization from network input buffers. CWE-502 (Deserialization of Untrusted Data) identifies the root cause: Java deserialization automatically invokes static initializers and readObject() methods during class loading, before application-level validation can occur. The original CVE-2024-52046 fix attempted to implement a classname allowlist, but this incomplete patch applied filtering after the ClassLoader already loaded and initialized classes. Attackers can craft serialized payloads containing classes with malicious static blocks that execute during deserialization, bypassing the allowlist entirely. The corrected implementation in 2.0.28/2.1.11/2.2.6 applies allowlist validation during the class resolution phase, before ClassLoader initialization.

RemediationAI

Upgrade immediately to Apache MINA 2.0.28, 2.1.11, or 2.2.6 depending on your deployed branch - vendor-released patches available per Apache advisory at https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Remove all IoBuffer.getObject() calls from application code and replace with explicit safe parsing logic - requires code refactoring but eliminates vulnerability surface entirely; (2) Deploy network segmentation to restrict MINA listener endpoints to trusted clients only - reduces attack surface but does not prevent exploitation by compromised internal systems; (3) Implement Java Security Manager policies blocking ObjectInputStream usage - may break legitimate application functionality and requires extensive testing. Note that the previous CVE-2024-52046 patch does NOT protect against this bypass, so staying on 2.0.27/2.1.10/2.2.5 provides no security benefit over earlier versions.