9.8
CriticalCVSS 3.1 · from apache
CVE-2026-41635
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE
org.apache.mina:mina-core · Unsafe deserialization · CWE-502Affectedorg.apache.mina:mina-core
FixNo fix listed yet.
PublishedApr 27, 08:59 · apache
ScoredApr 27 · 9.8 · apache
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.
From apache
Affected and fixed versions
ProductAffectedFixed inorg.apache.mina:mina-core2.2.0 – 2.2.5–org.apache.mina:mina-core2.1.0 – 2.1.10–org.apache.mina:mina-core2.0.0 – 2.0.27–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known