Summary
It was discovered that Apache MINA lacked an acceptMatchers allowlist
mechanism to restrict which classes could be deserialized. An attacker
could use this to execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-52046)
It was discovered that Apache MINA's deserialization filter could be
bypassed via multiple code paths. An attacker could use this to execute
arbitrary code by sending a specially crafted serialized object over the
network. (CVE-2026-42778, CVE-2026-42779, CVE-2026-47065)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | mina2 | 2.1.5-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | mina2 | 2.2.1-3ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | mina2 | 2.2.1-4ubuntu0.1~esm1 |
Vulnerabilities 4
-
Critical 10.0CVE-2024-52046 EPSS 25%
Apache MINA: MINA applications using unbounded deserialization may allow RCE
The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by s…
-
Critical 9.8CVE-2026-42778 Public exploit
Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deseri…
-
Critical 9.8CVE-2026-42779 Public exploit
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the cl…
-
Critical 9.8
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.re…