CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
Apache MINA left the CVE-2026-47065 proxy filter-bypass fix off the 2.0 and 2.1 branches.
62
Vulnerability3 · 2 reads
CVE-2026-94301
Incomplete Fix Allows RCE in Apache MINA 2.0.x & 2.1.x
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
This vulnerability is a failure to properly apply a security patch for a critical deserialization flaw (CVE-2026-47065) in Apache MINA's ObjectSerializationDecoder. The fix, which was intended to enforce an allow-list via `resolveProxyClass()`, was only applied to the 2.2.x branch. The 2.0.x and 2.1.x branches were incorrectly announced as fixed but remain vulnerable, allowing an attacker to bypass the filter and achieve Remote Code Execution (RCE) via a crafted serialized object. All users on the 2.0.x and 2.1.x lines are affected, and the flaw is exploitable over the network without authentication.
What to do: If you are using any version of Apache MINA in the 2.0.x line (2.0.29, 2.0.30, and earlier 2.0.x releases) or the 2.1.x line (2.1.13, 2.1.14, and earlier 2.1.x releases), you are still vulnerable. You must upgrade to a patched version from the 2.2.x line (2.2.8 or later) where the fix was actually implemented. No workaround is available for the incomplete fix in the older branches.
| Product | Affected |
|---|---|
| Apache MINA | 2.0.29, 2.0.30, and all earlier 2.0.x releases |
| Apache MINA | 2.1.13, 2.1.14, and all earlier 2.1.x releases |
Estimated exposure
nicheunknown, but likely in the thousands of applications — The number of direct, public installations of Apache MINA is not well-documented; the estimate is based on it being a foundational, but not ubiquitously-deployed, network framework used in many Java applications.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H