CVE-2026-42779

CVE-2026-42779 — Apache MINA Deserialization Filter Bypass to RCE CVSS 3.1: 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-502 Deserialization of Untrusted Data Reporter: Venkatraman Kumar, Securin Advisory: Apache Mailing List Overview Apache MINA versions 2.1.0 through 2.1.11 and 2.2...

apache__mina-sshd_CVE-2023-35887_2-9-2

Apache MINA SSHD Apache MINA SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. It does not aim at being a replacement for the SSH client or SSH server from Unix operating systems, but rather provides support for Java based applications requiring SSH...

CVE-2026-42778-POC

CVE-2026-42778 Overview Incomplete fix in Apache MINA AbstractIoBuffer.getObject method. The classname allowlist validation that restricts which classes can be deserialized is applied too late, after static initializers in classes being read may have already executed. This occurs because the...

apache-mina-deserialization-security-assessment

CVE-2024-52046 - Apache MINA Deserialization RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Apache MINA deserialization risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|---...

org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell SSH public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key...

org.apache.sshd/sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification

A flaw was found in Apache MINA SSHD. When a Secure Shell SSH server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to...

org.apache.sshd/sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification

A flaw was found in Apache MINA SSHD. When a Secure Shell SSH server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to...

org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell SSH public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key...

CLEANSTART-2026-YK88676 Apache MINA SSHD is a Java library for client-side and server-side SSH

Security vulnerability affects the apache-nifi package. Apache MINA SSHD is a Java library for client-side and server-side SSH...

CLEANSTART-2026-FF06896 Authentication bypass in sshd-core in Apache MINA SSHD versions 2

Security vulnerability affects the apache-nifi package. Authentication bypass in sshd-core in Apache MINA SSHD versions 2...

CLEANSTART-2026-BG73470 Apache MINA SSHD is a Java library for client-side and server-side SSH

CVE-2026-93994 affects multiple packages. Apache MINA SSHD is a Java library for client-side and server-side SSH. See references for individual vulnerability details...

CLEANSTART-2026-NE75247 Authentication bypass in sshd-core in Apache MINA SSHD versions 2

CVE-2026-77185 affects multiple packages. Authentication bypass in sshd-core in Apache MINA SSHD versions 2. See references for individual vulnerability details...

CLEANSTART-2026-ZE29292 Apache MINA SSHD is a Java library for client-side and server-side SSH

Security vulnerability affects the sonarqube package. Apache MINA SSHD is a Java library for client-side and server-side SSH...

CLEANSTART-2026-YA75138 Authentication bypass in sshd-core in Apache MINA SSHD versions 2

Security vulnerability affects the sonarqube package. Authentication bypass in sshd-core in Apache MINA SSHD versions 2...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Apache MINA SSHD

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in Apache MINA SSHD. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-77185 DESCRIPTION: Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and...

CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636

The Apache MINA codec module (branch 3.0.0) contains an unsafe deserialization vulnerability in JavaNativeMessageDecoder . The component calls ObjectInputStream.readObject() on frame bytes without a class filter, allowing an attacker to execute a gadget-chain RCE when the application interacts wi...

Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle and Apache MINA SSHD vulnerabilities that may cause denial of service, resource exhaustion, cryptographic verification bypass, or authentication issues.

Summary IBM Tivoli Netcool Configuration Manager version 6.4.2 addresses multiple vulnerabilities in Bouncy Castle and Apache MINA SSHD components. These vulnerabilities could allow attackers to cause denial of service, excessive resource consumption, application crashes, bypass cryptographic...