Apache Mina
Monthly
Unauthenticated remote code execution risk in Apache MINA 2.0.X through 2.0.30 and 2.1.X through 2.1.14 arises because those maintenance branches never received the resolveProxyClass() override that closed CVE-2026-47065. An attacker who can reach an application that uses MINA's ObjectSerializationDecoder and relies on acceptMatchers can wrap a malicious serialized object in java.lang.reflect.Proxy to bypass the allow-list, and, if a suitable gadget chain is present, execute code. No public exploit identified at time of analysis; upgrades within 2.0.X or 2.1.X do not remediate, so affected users must move to the 2.2.X line at 2.2.8 or later.
Memory exhaustion in Apache MINA's CompressionFilter lets unauthenticated remote attackers crash the affected JVM by sending ZLib-compressed data that inflates to an unbounded size, since the pre-fix filter allocates an output buffer proportional to the decompressed result without enforcing any limit (CWE-409, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The flaw is reachable only in deployments that instantiate the filter for inbound decompression (compressInbound=true) and expose that endpoint to untrusted network peers; applications that never enable CompressionFilter, or that already configure a maxDecompressedSize bound, are not affected. Our assessment rates this a genuine but bounded availability risk rather than a critical priority, and no public exploit code was identified at time of analysis; there is no KEV listing or confirmed in-the-wild activity.
Unsafe Java deserialization in Apache MINA's ObjectSerializationDecoder allows remote unauthenticated attackers to bypass the acceptMatchers class allow-list and achieve arbitrary code execution. Two distinct flaws are addressed: a TC_PROXYCLASSDESC handling gap where resolveProxyClass is not overridden (permitting java.lang.reflect.Proxy instantiation outside the allow-list), and a Class.forName invocation in readClassDescriptor that triggers static initializers of allow-listed classes before any instance check. No public exploit identified at time of analysis, but the CVSS 9.8 rating and well-known deserialization attack patterns make this a high-priority issue for any application exposing MINA's object serialization codec.
Remote code execution in Apache MINA 2.1.0-2.1.11 and 2.2.0-2.2.6 allows unauthenticated attackers to execute arbitrary code via unsafe deserialization. The fix for prior CVE-2024-52046 was incomplete-the classname allowlist protecting IoBuffer.getObject() was applied too late, allowing malicious static initializers to execute before filtering. Confirmed actively exploited (CISA KEV). EPSS exploitation probability not provided, but the network-accessible, unauthenticated attack vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) combined with KEV status indicates immediate patching is critical for applications calling IoBuffer.getObject().
Remote unauthenticated code execution in Apache MINA 2.1.0-2.1.11 and 2.2.0-2.2.6 allows attackers to bypass class allowlist protections via unsafe deserialization. The vulnerability exists because the fix for CVE-2026-41635 was not backported to the 2.1.X and 2.2.X branches, leaving AbstractIoBuffer.resolveClass() susceptible to arbitrary class instantiation when applications call IoBuffer.getObject(). Only applications actively using MINA's deserialization features are affected. EPSS data not available; no KEV listing or public POC identified at time of analysis.
Remote unauthenticated attackers can execute arbitrary code in Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5 through unsafe deserialization in AbstractIoBuffer.getObject(). This is an incomplete fix bypass for CVE-2024-52046 where the classname allowlist validation occurs after static initializers execute, enabling attackers to trigger malicious code execution before security controls engage. Apache confirmed the flaw affects applications calling IoBuffer.getObject() and released patches in versions 2.0.28, 2.1.11, and 2.2.6. CVSS 9.8 critical score reflects network-accessible unauthenticated exploitation with complete system compromise potential.
Unauthenticated remote code execution risk in Apache MINA 2.0.X through 2.0.30 and 2.1.X through 2.1.14 arises because those maintenance branches never received the resolveProxyClass() override that closed CVE-2026-47065. An attacker who can reach an application that uses MINA's ObjectSerializationDecoder and relies on acceptMatchers can wrap a malicious serialized object in java.lang.reflect.Proxy to bypass the allow-list, and, if a suitable gadget chain is present, execute code. No public exploit identified at time of analysis; upgrades within 2.0.X or 2.1.X do not remediate, so affected users must move to the 2.2.X line at 2.2.8 or later.
Memory exhaustion in Apache MINA's CompressionFilter lets unauthenticated remote attackers crash the affected JVM by sending ZLib-compressed data that inflates to an unbounded size, since the pre-fix filter allocates an output buffer proportional to the decompressed result without enforcing any limit (CWE-409, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The flaw is reachable only in deployments that instantiate the filter for inbound decompression (compressInbound=true) and expose that endpoint to untrusted network peers; applications that never enable CompressionFilter, or that already configure a maxDecompressedSize bound, are not affected. Our assessment rates this a genuine but bounded availability risk rather than a critical priority, and no public exploit code was identified at time of analysis; there is no KEV listing or confirmed in-the-wild activity.
Unsafe Java deserialization in Apache MINA's ObjectSerializationDecoder allows remote unauthenticated attackers to bypass the acceptMatchers class allow-list and achieve arbitrary code execution. Two distinct flaws are addressed: a TC_PROXYCLASSDESC handling gap where resolveProxyClass is not overridden (permitting java.lang.reflect.Proxy instantiation outside the allow-list), and a Class.forName invocation in readClassDescriptor that triggers static initializers of allow-listed classes before any instance check. No public exploit identified at time of analysis, but the CVSS 9.8 rating and well-known deserialization attack patterns make this a high-priority issue for any application exposing MINA's object serialization codec.
Remote code execution in Apache MINA 2.1.0-2.1.11 and 2.2.0-2.2.6 allows unauthenticated attackers to execute arbitrary code via unsafe deserialization. The fix for prior CVE-2024-52046 was incomplete-the classname allowlist protecting IoBuffer.getObject() was applied too late, allowing malicious static initializers to execute before filtering. Confirmed actively exploited (CISA KEV). EPSS exploitation probability not provided, but the network-accessible, unauthenticated attack vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) combined with KEV status indicates immediate patching is critical for applications calling IoBuffer.getObject().
Remote unauthenticated code execution in Apache MINA 2.1.0-2.1.11 and 2.2.0-2.2.6 allows attackers to bypass class allowlist protections via unsafe deserialization. The vulnerability exists because the fix for CVE-2026-41635 was not backported to the 2.1.X and 2.2.X branches, leaving AbstractIoBuffer.resolveClass() susceptible to arbitrary class instantiation when applications call IoBuffer.getObject(). Only applications actively using MINA's deserialization features are affected. EPSS data not available; no KEV listing or public POC identified at time of analysis.
Remote unauthenticated attackers can execute arbitrary code in Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5 through unsafe deserialization in AbstractIoBuffer.getObject(). This is an incomplete fix bypass for CVE-2024-52046 where the classname allowlist validation occurs after static initializers execute, enabling attackers to trigger malicious code execution before security controls engage. Apache confirmed the flaw affects applications calling IoBuffer.getObject() and released patches in versions 2.0.28, 2.1.11, and 2.2.6. CVSS 9.8 critical score reflects network-accessible unauthenticated exploitation with complete system compromise potential.