CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes of SomeClass — and many real-world classes have side-effecting static initialisers Both issues have been fixed.

This vulnerability is a failure to properly apply a security patch for a critical deserialization flaw (CVE-2026-47065) in Apache MINA's ObjectSerializationDecoder. The fix, which was intended to enforce an allow-list via `resolveProxyClass()`, was only applied to the 2.2.x branch. The 2.0.x and 2.1.x branches were incorrectly announced as fixed but remain vulnerable, allowing an attacker to bypass the filter and achieve Remote Code Execution (RCE) via a crafted serialized object. All users on the 2.0.x and 2.1.x lines are affected, and the flaw is exploitable over the network without authentication.

Do: If you are using any version of Apache MINA in the 2.0.x line (2.0.29, 2.0.30, and earlier 2.0.x releases) or the 2.1.x line (2.1.13, 2.1.14, and earlier 2.1.x releases), you are still vulnerable. You must upgrade to a patched version from the 2.2.x line (2.2.8 or later) where the fix was actually implemented. No workaround is available for the incomplete fix in the older branches.