CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE

🗓️ 25 Dec 2024 10:06:23Reported by apacheType

Apache MINA's deserialization flaw permits remote code execution; upgrade and adjust settings required.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (March 2025)	27 Mar 202516:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in org.apache.mina_mina-core affects IBM Db2 Data Management Console(CVE-2024-52046)	23 Jul 202520:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for April 2025 - Multiple CVEs addressed	7 May 202520:48	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of mina-core IBM My webMethods Server is vulnerable to Insecure Java Deserilization	23 Jun 202511:51	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the Use Apache MINA Core, IBM App Connect Professional is vulnerable to Remote Code Execution	15 Apr 202504:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream and Apache MINA might affect IBM Storage Defender Copy Data Management.	16 May 202519:22	–	ibm
ATTACKERKB	CVE-2026-42778	1 May 202610:01	–	attackerkb
ATTACKERKB	CVE-2026-41409	27 Apr 202609:20	–	attackerkb
BDU FSTEC	The vulnerability of the ObjectSerializationDecoder decoder in the Apache MINA Java networking framework allows a attacker to execute arbitrary code.	9 Jan 202500:00	–	bdu_fstec
Chainguard	CVE-2024-52046 vulnerabilities	25 Dec 202410:15	–	cgr

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.mina:mina-core",
    "product": "Apache MINA",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.0.26",
        "status": "unknown",
        "version": "2.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "2.1.9",
        "status": "affected",
        "version": "2.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "2.2.3",
        "status": "affected",
        "version": "2.2",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8

12 Feb 2025 09:33Current

CVSS 410

EPSS0.55384

CWE-502