Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache MINA

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-42778 Public exploit

    Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)

    The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deseri…

    Apache Software Foundation Apache MINA mina2 org.apache.mina:mina-core Ubuntu Maven
  • Critical 9.8
    CVE-2026-42779 Public exploit

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

    The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the cl…

    Apache Software Foundation Apache MINA mina2 org.apache.mina:mina-core Ubuntu Maven