Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

🗓️ 03 Jun 2026 12:30:26Reported by GitHub Advisory DatabaseType

Fixes deserialization bypasses in Apache MINA via proxy class resolution and allow-list initialisers.

Reporter	Title	Published	Views	Family All 102
IBM Security Bulletins	Security Bulletin: Insecure Deserialization Vulnerability in Mina Core Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-47065)	17 Sep 202612:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities	14 Sep 202613:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for June 2026 - Multiple CVEs addressed	8 Jul 202611:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management	30 Sep 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache-MINA libraries used by IBM Tivoli Netcool Configuration Manager	2 Jul 202605:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise	29 Jun 202609:47	–	ibm
attackerkb	CVE-2026-47065	3 Jun 202609:39	–	attackerkb
Chainguard	CVE-2026-47065 vulnerabilities	15 Jul 202602:16	–	cgr
Circl	CVE-2026-47065	3 Jun 202611:49	–	circl
CNNVD	Apache MINA 代码问题漏洞	3 Jun 202600:00	–	cnnvd

Vulners

Node

org.apache.mina mina-coreRange2.1.0–2.1.13maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47065
lists	www.lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj
github	www.github.com/advisories/GHSA-v3pr-hxpr-mfm8

13 Jul 2026 17:24Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.8

EPSS0.00504

SSVC