GHSA-VF5J-865M-MQ7C Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

🗓️ 01 May 2026 12:30:25Reported by GoogleType

osv🔗 osv.dev👁 7 Views

Apache MINA deserialization flaw CVE 2026-41635; incomplete fix in 2.1.x and 2.2.x; upgrade to 2.1.12 or 2.2.7.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: IBM webMethods BPM is vulnerable to Deserialization of Untrusted Data	17 Jun 202609:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache-MINA libraries used by IBM Tivoli Netcool Configuration Manager	2 Jul 202605:15	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Mina	2 May 202608:26	–	githubexploit
ATTACKERKB	CVE-2026-42779	1 May 202610:00	–	attackerkb
BDU FSTEC	The vulnerability of the Apache MINA network Java application framework, related to deserialization mechanism flaws, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	6 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42779 vulnerabilities	8 May 202613:17	–	cgr
Circl	CVE-2026-42779	1 May 202612:50	–	circl
CNNVD	Apache MINA 代码问题漏洞	1 May 202600:00	–	cnnvd
CVE	CVE-2026-42779	1 May 202610:00	–	cve
Cvelist	CVE-2026-42779 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)	1 May 202610:00	–	cvelist

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42779
github	www.github.com/advisories/GHSA-8297-v2rf-2p32
github	www.github.com/apache/mina
lists	www.lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0

08 May 2026 03:14Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8

EPSS0.00902