CVEsApache Software FoundationCVE-2026-42779Published May 1, 10:00 · Updated May 2, 03:55 UTC
9.8
CriticalCVSS 3.1 · from apache
CVE-2026-42779

Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

org.apache.mina:mina-core · Unsafe deserialization · CWE-502
Affectedorg.apache.mina:mina-core
FixNo fix listed yet.
PublishedMay 1, 10:00 · apache
ScoredMay 1 · 9.8 · apache
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC

What we know

No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.

Description

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.

From apache

Affected and fixed versions

ProductAffectedFixed inorg.apache.mina:mina-core2.2.X – 2.2.6–org.apache.mina:mina-core2.1.X – 2.1.11–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0 · lists.apache.orgvendor advisory

Other CVEs in org.apache.mina:mina-core

All 4 →
9.8Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder · CVE-2026-118636Oct 319.8Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 · CVE-2026-47065Jun 39.8Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE · CVE-2026-41635Apr 27