CVE-2026-47065: Apache Java Deserialization filter bypass via resolveProxyClass

CVE-2026-47065 · Severity: critical · CVSS 9.8 · Published 2026-06-03

Apache MINA, a network application framework used to build high-performance applications, is vulnerable to a critical security flaw in how it handles data sent over the network. An attacker can bypass security filters to execute unauthorized code or trigger unintended actions by sending specially crafted data. This could lead to a full system takeover, data theft, or service disruption. Users should update to the latest patched versions immediately.

Technologies: org.apache.mina:mina-core (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-47065 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47065 being exploited in the wild.
How severe is CVE-2026-47065?
Critical severity, with a CVSS score of 9.8, published 3 June 2026.
Which products and versions are affected?
org.apache.mina:mina-core (Maven) ECOSYSTEM:introduced=2.2.0,fixed=2.2.8.
Is there a fix for CVE-2026-47065?
Yes. org.apache.mina:mina-core (Maven): upgrade to 2.2.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47065 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47065?
Check whether you run Apache Software Foundation ObjectInputStream or org.apache.mina:mina-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.mina:mina-core (Maven): upgrade to 2.2.8 or later
    # set org.apache.mina:mina-core to 2.2.8 in your pom.xml or build.gradle

Technical details

This vulnerability involves two distinct issues in Apache MINA's deserialization logic (CWE-502). First, the implementation fails to override ObjectInputStream.resolveProxyClass, allowing an attacker to use TC_PROXYCLASSDESC to bypass the accepted classes list and construct proxy classes. Second, the readClassDescriptor implementation uses Class.forName with initialization enabled, which triggers the static initializers (<clinit>) of any class on the allow-list before instance construction. A remote, unauthenticated attacker can exploit these behaviors via the network to achieve remote code execution or cause side effects through static initializers. The issues are addressed in versions 2.2.8, 2.1.13, and 2.0.29.

Affected products

  • Apache Software Foundation MINA >= 2.2.0, < 2.2.8; >= 2.1.0, < 2.1.13; < 2.0.29

Identifiers

  • CVE-2026-47065
  • GHSA-v3pr-hxpr-mfm8

Timeline

  • 2026-06-03: advisory: Initial disclosure by Apache and NVD
  • 2026-06-03: patched: Patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.