Apache MINA (Product): news timeline & CVEs

CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

Apache MINA left the CVE-2026-47065 proxy filter-bypass fix off the 2.0 and 2.1 branches.

Apache MINA assigned CVE-2026-94301 because the fix for CVE-2026-47065 (ZDRES-232) was not present on the 2.0.x and 2.1.x branches. That issue is an acceptMatchers filter bypass: resolveProxyClass is not overridden, so java.lang.reflect.Proxy objects can pass the filter. The fix, announced on 2026-06-02 as fully addressed in 2.2.8, 2.1.13, and 2.0.29, was committed only to 2.2.x. Releases before 2.0.31 and 2.1.15, including 2.0.30 and 2.1.14, remain affected. No in-the-wild exploitation is reported.

oss-securitySep 21, 17:06 UTC · 5d agoVulnerability 2 sources CVE-2026-94301 CVE-2026-47065

CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

Apache MINA CompressionFilter allows unbounded zlib inflation, enabling a decompression-amplification denial of service.

CVE-2026-47321 is an unbounded decompression flaw in Apache MINA's mina-filter-compression component. CompressionFilter uses Zlib to inflate incoming data but does not limit the resulting size, allowing a decompression-amplification denial of service. Affected versions are 2.2.0 before 2.2.8, 2.1.0 before 2.1.13, and 2.0.0 before 2.0.29. The oss-security post does not report exploitation in the wild.

oss-securitySep 21, 17:04 UTC · 5d agoVulnerability 2 sources CVE-2026-47321

Apache MINA

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate