apache-mina-deserialization-security-assessment

CVE-2024-52046 - Apache MINA Deserialization RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Apache MINA deserialization risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|---...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache MINA vulnerabilities (USN-8465-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8465-1 advisory. It was discovered that Apache MINA lacked an acceptMatchers allowlist mechanism to restrict which classes could be deserialized. ...

USN-8465-1 mina2 vulnerabilities

It was discovered that Apache MINA lacked an acceptMatchers allowlist mechanism to restrict which classes could be deserialized. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2024-52046 It was discovered that Apache MINA'...

OESA-2026-2244 apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fixes: The fix for...

OESA-2026-2243 apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fixes: The fix for...

UBUNTU-CVE-2026-42778

The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a stat...

PT-2026-36314

Name of the Vulnerable Software and Affected Versions Apache MINA versions prior to 2.2.7 Apache MINA versions prior to 2.1.12 Description An issue exists in the Java network application framework due to flaws in the deserialization mechanism. The software deserializes data from unknown network...

asia.stampy:stampy-all (1.0-release), asia.stampy:stampy-examples (1.0-release) +2014 more potentially affected by CVE-2024-52046 +1 more via org.apache.mina:mina-core (>=2.0.0, <=2.0.27)

org.apache.mina:mina-core MAVEN version =2.0.0, =37.v0d3157c4aef8, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0.release, =1.0.0.release, =1.0.0.release, =1.0.2.release, =2.0.0, =1.0.7, =1.1.6, =1.6.8 - co.actioniq:scala-ssh-shell2.10 0.0.1-9045f42e1634ad6f74edf826b9c7c61d1a495a38 and mo...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.2.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +493 more potentially affected by CVE-2024-52046 +1 more via org.apache.mina:mina-core (>=2.1.0, <=2.1.10)

org.apache.mina:mina-core MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =2.0.0, =2.0.0, =1.0.0, =3.3.0, =2.5.2.release,...

asia.stampy:stampy-all (1.0-release), asia.stampy:stampy-examples (1.0-release) +2014 more potentially affected by CVE-2024-52046 +1 more via org.apache.mina:mina-core (>=2.0.0, <=2.0.27)

org.apache.mina:mina-core MAVEN version =2.0.0, =37.v0d3157c4aef8, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0.release, =1.0.0.release, =1.0.0.release, =1.0.2.release, =2.0.0, =1.0.7, =1.1.6, =1.6.8 - co.actioniq:scala-ssh-shell2.10 0.0.1-9045f42e1634ad6f74edf826b9c7c61d1a495a38 and mo...

DEBIAN-CVE-2026-41409

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 =...

CVE-2026-41409

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 =...

EUVD-2026-25809

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 =...

Linux Distros Unpatched Vulnerability : CVE-2024-52046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ObjectSerializationDecoder in Apache MINA uses Java's native deserialization protocol to process incoming serialized data but lacks the necessary security...

Security Bulletin: Due to use of mina-core IBM My webMethods Server is vulnerable to Insecure Java Deserilization

Summary IBM My webMethods Server includes mina-core as part of its OSGi platform, which is affected by a known vulnerability CVE-2024-52046. This security bulletin provides guidance on addressing the vulnerability. Vulnerability Details CVEID:CVE-2024-52046 DESCRIPTION: The...

Security Bulletin: Due to the Use Apache MINA Core, IBM App Connect Professional is vulnerable to Remote Code Execution

Summary Apache MINA Core is used by IBM App Connect Professional CVE-2024-52046 Vulnerability Details CVEID:CVE-2024-52046 DESCRIPTION: The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security...

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization

The Apache Software Foundation ASF has released patches to address a maximum severity vulnerability in the MINA Java network application framework that could result in remote code execution under specific conditions. Tracked as CVE-2024-52046 , the vulnerability carries a CVSS score of 10.0. It...

ai.h2o:sparkling-water-core_2.11 (>=3.46.0.1-1-2.3, <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.46.0.1-1-3.0, <=3.46.0.6-1-3.5) +659 more potentially affected by CVE-2024-52046 via org.apache.mina:mina-core (>=2.2.0, <=2.2.3)

org.apache.mina:mina-core MAVEN version =2.2.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =0.10, =1.2.0 - com.dinstone.beanstalkc:beanstalkc-mina 2.4.0 and more...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.2.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +493 more potentially affected by CVE-2024-52046 via org.apache.mina:mina-core (>=2.1.0, <=2.1.9)

org.apache.mina:mina-core MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =2.0.0, =2.0.0, =1.0.0, =3.3.0, =2.5.2.release,...

asia.stampy:stampy-all (1.0-release), asia.stampy:stampy-examples (1.0-release) +2202 more potentially affected by CVE-2024-52046 via org.apache.mina:mina-core (>=2.0.0-m1, <=2.0.26)

org.apache.mina:mina-core MAVEN version =2.0.0-m1, =1.0.1.release, =1.1.8.release, =1.1.5.release, =2.7.4.0, =1.0.0.release, =1.0.0.release, =1.0.0.release, =1.0.2.release, =1.0.3.release - cn.javaboot:nacos-address 1.4.1 - cn.javaboot:nacos-console 1.4.1 - cn.javaboot:nacos-distribution 1.4.1 -...