9.8
Critical
CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via…
Description
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache MINA 2.1 | 2.1.0 → < 2.1.15 | 2.1.15 |
| Apache MINA 2.0 | 2.0.0 → < 2.0.31 | 2.0.31 |
References
- lists.apache.org lists.apache.org
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache MINA
The 11 CVEs of Apache MINA →
CVE-2026-118636
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…
9.8
Critical
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received
7.5
High
CVE-2026-47065
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully…
9.8
Critical
CVE-2026-42778
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches
9.8
Critical