The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:




The fix for CVE-2024-52046 in Apache MI…

CVE-2026-42778 represents an incomplete fix for a previous vulnerability in Apache MINA's AbstractIoBuffer.getObject() method. The original fix for CVE-2024-52046 was not properly applied to branches 2.1.X and 2.2.X. The vulnerability stems from a classname allowlist for deserialization being applied too late, allowing static initializers to execute before validation. This affects Apache MINA versions 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6. Applications using IoBuffer.getObject() are at risk. The issue is resolved in versions 2.1.12 and 2.2.7 by applying the allowlist earlier in the process.