CVE-2026-47065

CVE-2026-47065 (Apache MINA context) describes two deserialization bypass issues: first, resolveProxyClass bypasses the accept/allow-list when JDK resolves proxy interfaces from a serialized proxy via ObjectInputStream.readProxyDesc(), and second, readClassDescriptor triggers static initializers ...

CVE-2026-42779

CVE-2026-42779 affects Apache MINA’s AbstractIoBuffer.resolveClass(), where one branch bypasses the classname allowlist and permits arbitrary class loading, enabling potential remote code execution via IoBuffer.getObject(). Affected are MINA 2.1.0–2.1.11 and 2.2.0–2.2.6. The issue is fixed by int...

CVE-2026-41409

Apache MINA is affected by CVE-2026-41409 due to an incomplete fix for CVE-2024-52046 in AbstractIoBuffer.getObject(). The classname allowlist for deserialization was enforced too late after a class static initializer could already run. Affected versions: MINA 2.0.0–2.0.27, 2.1.0–2.1.10, 2.2.0–2....

CVE-2026-41635

Summary: CVE-2026-41635 affects Apache MINA’s AbstractIoBuffer.resolveClass(), where one code path for static/primitive types neglects the class check and bypasses the classname allowlist, enabling arbitrary code execution through object deserialization. Impact and scope: Affects MINA versions 2....

CVE-2026-42778

Apache MINA CVE-2026-42778 affects IoBuffer.getObject() deserialization. Affected: MINA 2.1.0–2.1.11 and 2.2.0–2.2.6 (also 2.1.0–2.1.110 in one note). Root cause: incomplete earlier fix for CVE-2024-52046; classname allowlist was applied too late. Impact: deserialization of untrusted data via IoB...