CVE-2026-94301
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
Risk Assessment
Applications using MINA 2.0.X or 2.1.X remain vulnerable to the allow-list bypass even though those versions were labeled as fixed. This may allow an attacker to bypass security filters and perform unauthorized operations.
Recommendation
Do not rely on 2.0.29/2.1.13 or later releases from the 2.0.X/2.1.X branches as fixed -- upgrade to the 2.2.X branch (2.2.8 or later) or apply your own resolveProxyClass() override. Verify that the artifacts in use actually contain the fix.
Other vulnerabilities in Apache MINA
See all- CVE-2026-118636Critical
The JavaNativeMessageDecoder class in the Apache MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without any class filter. An application that places it in front of an untrusted peer is exposed to gadget-chain remote code execution. The 3.0.0 branch is inactive and no fix will be released for it.
- CVE-2026-42779Critical
Apache MINA versions 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6 are vulnerable to arbitrary code execution due to a lack of class verification in the AbstractIoBuffer.resolveClass() method. The fix was introduced in versions 2.1.12 and 2.2.7.
- CVE-2026-42778Critical
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete and was not applied to the 2.1.X and 2.2.X branches. The classname allowlist was applied too late, after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.1.0–2.1.11 and 2.2.0–2.2.6; the issue is resolved in 2.1.12 and 2.2.7.
- CVE-2026-47321High
The CompressionFilter class in Apache MINA uses ZLib to deflate and inflate data, but does not control the resulting buffer size during decompression. Maliciously compressed data with a very high compression ratio can exhaust application memory. The fix introduces limits on the maximum decompressed size and compression ratio.
- CVE-2023-35887Medium
CVE-2023-35887 vulnerability in Apache MINA exposes sensitive information to unauthorized actors. Logged users on SFTP servers may discover 'exists/does not exist' information about items outside the rooted tree using parent navigation or symlinks.
Original NVD description (English source)
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS