Executive brief
Apache MINA, a network application framework used to build high-performance applications, is vulnerable to a critical security flaw in how it handles data sent over the network. An attacker can bypass security filters to execute unauthorized code or trigger unintended actions by sending specially crafted data. This could lead to a full system takeover, data theft, or service disruption. Users should update to the latest patched versions immediately.
Technical details
This vulnerability involves two distinct issues in Apache MINA's deserialization logic (CWE-502). First, the implementation fails to override ObjectInputStream.resolveProxyClass, allowing an attacker to use TC_PROXYCLASSDESC to bypass the accepted classes list and construct proxy classes. Second, the readClassDescriptor implementation uses Class.forName with initialization enabled, which triggers the static initializers (<clinit>) of any class on the allow-list before instance construction. A remote, unauthenticated attacker can exploit these behaviors via the network to achieve remote code execution or cause side effects through static initializers. The issues are addressed in versions 2.2.8, 2.1.13, and 2.0.29.
Affected products
- Apache Software Foundation MINA >= 2.2.0, < 2.2.8; >= 2.1.0, < 2.1.13; < 2.0.29
Timeline
- 2026-06-03: advisory: Initial disclosure by Apache and NVD
- 2026-06-03: patched: Patched versions released