Apache MINA

Mentions · 7d0
Mentions · 30d1
All mentions3
First seenSep 21, 2026
Last mentioned11d ago

Timeline

3 articles · newest first

Apache MINA 3.0.0 through 3.0.0-M2 unsafe deserialization (CVE-2026-118636)

JavaNativeMessageDecoder calls ObjectInputStream.readObject() with no class filter; the issue was unsupported when assigned.

oss-securityOct 31, 08:14 UTC · 11d agoVulnerabilityCVE-2026-1186361

CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

Apache MINA left the CVE-2026-47065 proxy filter-bypass fix off the 2.0 and 2.1 branches.

oss-securitySep 21, 17:06 UTC · Sep 21, 2026Vulnerability 2 sourcesCVE-2026-94301 CVE-2026-470651

CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

Apache MINA CompressionFilter allows unbounded zlib inflation, enabling a decompression-amplification denial of service.

oss-securitySep 21, 17:04 UTC · Sep 21, 2026Vulnerability 2 sourcesCVE-2026-473211 · 1 read

Related CVEs

by mentions

CVE-2026-47065<1%9.8
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment
published Jun 3, 2026apache mina
CVE-2026-1186369.8
Gadget-chain RCE in Apache MINA JavaNativeMessageDecoder
published 11d agoApache MINA
CVE-2026-943019.8
Incomplete Fix Allows RCE in Apache MINA 2.0.x & 2.1.x
published Sep 21, 2026Apache MINA
CVE-2026-473217.5
Decompression bomb denial-of-service in Apache MINA CompressionFilter
published Sep 21, 2026Apache MINA (CompressionFilter class using ZLib inflate)

Appears with

Apachevendor · 3
Apache Software Foundationorganization · 2
mina-filter-compressionproduct · 1

Entities are extracted by the model from each article. First seen Sep 21, 2026, last mentioned 11d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.