Executive brief
Apache MINA, a networking framework used to build scalable server and client applications, contains an incomplete fix for a critical filter bypass vulnerability. The security patch was only applied to one maintenance branch, leaving deployed versions in two other branches vulnerable to the same attack that allows malicious data to bypass access control filters, potentially exposing the application to unauthorized network access.
Technical details
The resolveProxyClass() method override that was meant to fix CVE-2026-47065 (a java.lang.reflect.Proxy-based acceptMatchers filter bypass) was committed only to the 2.2.X branch. The 2.0.X and 2.1.X maintenance branches never received this fix, making versions 2.0.30 and 2.1.14 (and all earlier releases on those lines, including those marked as "fixed" in CVE-2026-47065) vulnerable to the same allow-list bypass. An attacker with network access can exploit java.lang.reflect.Proxy to circumvent the input validation filters.
Affected products
- Apache MINA 2.0.0 through 2.0.30, 2.1.0 through 2.1.14
Timeline
- 2026-09-21: disclosed: CVE-2026-94301 published
- 2026-06-02: patched: Fix for CVE-2026-47065 committed to 2.2.X branch only; 2.0.X and 2.1.X branches never received the resolveProxyClass() override