Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-41409

Apache MINA: CWE-502 Deserialization of Untrusted Data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache MINA

Default version status: unaffected

  • 2.2.0 to ≤ 2.2.5affected
  • 2.1.0 to ≤ 2.1.10affected
  • 2.0.0 to ≤ 2.0.27affected

References