CVE-2026-42779
CriticalSummary
Apache MINA versions 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6 are vulnerable to arbitrary code execution due to a lack of class verification in the AbstractIoBuffer.resolveClass() method. The fix was introduced in versions 2.1.12 and 2.2.7.
Risk Assessment
Organizations using the vulnerable versions of Apache MINA may be exposed to arbitrary code execution, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to Apache MINA versions 2.1.12 or 2.2.7 to mitigate this vulnerability.
Other vulnerabilities in Apache MINA
See all- CVE-2026-94301Critical
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
- CVE-2026-42778Critical
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches of Apache MINA. The issue concerns an incomplete fix for CVE-2024-52046, where the classname allowlist for deserialization was applied too late.
- CVE-2026-47321High
The CompressionFilter class in Apache MINA uses ZLib to deflate and inflate data, but does not control the resulting buffer size during decompression. Maliciously compressed data with a very high compression ratio can exhaust application memory. The fix introduces limits on the maximum decompressed size and compression ratio.
- CVE-2023-35887Medium
CVE-2023-35887 vulnerability in Apache MINA exposes sensitive information to unauthorized actors. Logged users on SFTP servers may discover 'exists/does not exist' information about items outside the rooted tree using parent navigation or symlinks.
Original NVD description (English source)
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS