GHSA-995C-6RP3-4M4X Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)

🗓️ 01 May 2026 12:30:25Reported by GoogleType

osv🔗 osv.dev👁 10 Views

Apache MINA deserialization flaw CVE-2026-41409 remains in 2.1.x and 2.2.x; upgrade to 2.1.12 or 2.2.7.

Reporter	Title	Published	Views	Family All 58
IBM Security Bulletins	Security Bulletin: IBM webMethods BPM is vulnerable to Deserialization of Untrusted Data	17 Jun 202609:47	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-42778, CVE-2026-42779)	3 Sep 202619:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache-MINA libraries used by IBM Tivoli Netcool Configuration Manager	2 Jul 202605:15	–	ibm
ATTACKERKB	CVE-2026-42778	1 May 202610:01	–	attackerkb
BDU FSTEC	The vulnerability of the Apache MINA network Java application framework, related to deserialization mechanism flaws, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	6 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42778 vulnerabilities	8 May 202613:17	–	cgr
Circl	CVE-2026-42778	1 May 202610:30	–	circl
CNNVD	Apache MINA 代码问题漏洞	1 May 202600:00	–	cnnvd
CVE	CVE-2026-42778	1 May 202610:01	–	cve
Cvelist	CVE-2026-42778 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)	1 May 202610:01	–	cvelist

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42778
github	www.github.com/advisories/GHSA-76h9-2vwh-w278
github	www.github.com/advisories/GHSA-f2wh-grmh-r6jm
github	www.github.com/apache/mina
lists	www.lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0

08 May 2026 03:14Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.00657

apache mina deserialization vulnerability 2026 41409 affected versions 2.1.x upgrade 2.1.12 upgrade 2.2.7