EUVD-2026-26493

🗓️ 01 May 2026 10:00:43Reported by EUVDType

CVE fix for classname allowlist missing in MINA 2.1 and 2.2 branches; upgrade to 2.1.12 or 2.2.7 to secure IoBuffer.getObject().

Reporter	Title	Published	Views	Family All 90
ibm	Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise	27 May 202617:14	–	ibm
ibm	Security Bulletin: IBM webMethods BPM is vulnerable to Deserialization of Untrusted Data	17 Jun 202609:47	–	ibm
ibm	Security Bulletin: Multiple Security Vulnerabilities in Apache-MINA libraries used by IBM Tivoli Netcool Configuration Manager	2 Jul 202605:15	–	ibm
githubexploit	Exploit for Deserialization of Untrusted Data in Apache Mina	2 May 202608:26	–	githubexploit
attackerkb	CVE-2026-41635	27 Apr 202608:59	–	attackerkb
attackerkb	CVE-2026-42779	1 May 202610:00	–	attackerkb
bdu_fstec	The vulnerability of the Apache MINA network Java application framework, related to deserialization mechanism flaws, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	6 May 202600:00	–	bdu_fstec
cgr	CVE-2026-41635 vulnerabilities	8 May 202613:17	–	cgr
cgr	CVE-2026-42779 vulnerabilities	8 May 202613:17	–	cgr
circl	CVE-2026-41635	27 Apr 202609:09	–	circl

[
  {
    "enisaIdVendor": [
      {
        "id": "d06781f3-6c02-30d5-b6c2-d05e98c2dc71",
        "vendor": {
          "name": "Apache Software Foundation"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "1d15794f-c104-3222-8fd3-b948fd33cc4b",
        "product": {
          "name": "Apache MINA"
        },
        "product_version": "2.2.X ≤2.2.6"
      },
      {
        "id": "df9c7f56-7c8c-34cd-840c-c83b43eba670",
        "product": {
          "name": "Apache MINA"
        },
        "product_version": "2.1.X ≤2.1.11"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0

01 May 2026 10:00Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8

EPSS0.00902

SSVC