Skip to content
fr Sign in
9.8 Critical

CVE-2026-42779 The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches

Description

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.

Affected products and versions

Product Affected versions Fixed in
Apache MINA 2.2 2.2.X → 2.2.6 No fix stated
Apache MINA 2.1 2.1.X → 2.1.11 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache MINA

The 11 CVEs of Apache MINA →
CVE-2026-118636 **UNSUPPORTED WHEN ASSIGNED**  JavaNativeMessageDecoder in the MINA 3.0 codec module calls… 9.8 Critical CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via… 9.8 Critical CVE-2026-47321 The CompressionFilter class uses ZLib to deflate and inflate data sent and received 7.5 High CVE-2026-47065 ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully… 9.8 Critical
Track this CVE