Aller au contenu
en Se connecter
9.8 Critique

CVE-2026-42779 The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches

Description

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache MINA 2.2 2.2.X → 2.2.6 Pas de correctif indiqué
Apache MINA 2.1 2.1.X → 2.1.11 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache MINA

Les 11 CVE de Apache MINA →
CVE-2026-118636 **UNSUPPORTED WHEN ASSIGNED**  JavaNativeMessageDecoder in the MINA 3.0 codec module calls… 9.8 Critique CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via… 9.8 Critique CVE-2026-47321 The CompressionFilter class uses ZLib to deflate and inflate data sent and received 7.5 Élevée CVE-2026-47065 ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully… 9.8 Critique
Suivre cette CVE