mina

3 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-47065

  Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

  ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.re…

  Apache Software Foundation Apache MINA apache-nifi jenkins-2-openjdk-21 Debian Ubuntu Wolfi Maven
  Jun 3, 2026
• Critical 9.8
  CVE-2026-41635

  Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE

  Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class…

  Apache Software Foundation Apache MINA jenkins-2-openjdk-21 jenkins-2-openjdk-25 Debian Ubuntu Wolfi Maven
  Apr 27, 2026
• Critical 10.0
  CVE-2024-52046 EPSS 25%

  Apache MINA: MINA applications using unbounded deserialization may allow RCE

  The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by s…

  Apache Software Foundation Apache MINA apache-nifi apache-nifi-toolkit Debian Ubuntu Wolfi Maven
  Dec 25, 2024