CVE-2026-42778-nvd.nist.gov-Analyzed

The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:

The fix for CVE-2024-52046 in Apache MI…

Published:

30 April 2026 at 22:00:00

Alert date:

1 May 2026 at 18:06:04

Source:

nvd.nist.gov

Enterprise Applications, Supply Chain & Dependencies

CVE-2026-42778 represents an incomplete fix for a previous vulnerability in Apache MINA's AbstractIoBuffer.getObject() method. The original fix for CVE-2024-52046 was not properly applied to branches 2.1.X and 2.2.X. The vulnerability stems from a classname allowlist for deserialization being applied too late, allowing static initializers to execute before validation. This affects Apache MINA versions 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6. Applications using IoBuffer.getObject() are at risk. The issue is resolved in versions 2.1.12 and 2.2.7 by applying the allowlist earlier in the process.

Technical details

Mitigation steps:

Affected products:

Apache MINA