9.8
Critique
CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via…
Description
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache MINA 2.1 | 2.1.0 → < 2.1.15 | 2.1.15 |
| Apache MINA 2.0 | 2.0.0 → < 2.0.31 | 2.0.31 |
Références
- lists.apache.org lists.apache.org
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache MINA
Les 11 CVE de Apache MINA →
CVE-2026-118636
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…
9.8
Critique
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received
7.5
Élevée
CVE-2026-47065
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully…
9.8
Critique
CVE-2026-42778
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches
9.8
Critique