The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:











Apache MINA's AbstractIoBuffer.r…

CVE-2026-42779 is a vulnerability in Apache MINA where the fix for CVE-2026-41635 was not applied to certain branches. The issue exists in AbstractIoBuffer.resolveClass() which contains branches that don't check classes, bypassing the classname allowlist and allowing arbitrary code execution. Affected versions include Apache MINA 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6. The vulnerability affects applications using Apache MINA that call IoBuffer.getObject(). The issue is resolved in versions 2.1.12 and 2.2.7 by applying the classname allowlist earlier in the process.