9.8
Critical
CVE-2026-41635 Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types)…
Description
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache MINA 2.2 | 2.2.0 → 2.2.5 | No fix stated |
| Apache MINA 2.1 | 2.1.0 → 2.1.10 | No fix stated |
| Apache MINA 2.0 | 2.0.0 → 2.0.27 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache MINA
The 11 CVEs of Apache MINA →
CVE-2026-118636
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…
9.8
Critical
CVE-2026-94301
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via…
9.8
Critical
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received
7.5
High
CVE-2026-47065
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully…
9.8
Critical