CVE-2026-41635-nvd.nist.gov-Received

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypass…

Published:

26 April 2026 at 22:00:00

Alert date:

27 April 2026 at 10:01:58

Source:

nvd.nist.gov

Network Infrastructure, Enterprise Applications

Apache MINA's AbstractIoBuffer.resolveClass() method contains a vulnerability that bypasses classname allowlist validation in one code branch for static classes or primitive types, allowing arbitrary code execution. The vulnerability affects applications using Apache MINA that call IoBuffer.getObject(). Affected versions include Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5. The issue is resolved in versions 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist filter earlier in the process before calling Class.forName(). Organizations using affected Apache MINA versions are advised to upgrade immediately.

Technical details

Mitigation steps:

Affected products:

Apache MINA