CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
Apache MINA left the CVE-2026-47065 proxy filter-bypass fix off the 2.0 and 2.1 branches.
Apache MINA assigned CVE-2026-94301 because the fix for CVE-2026-47065 (ZDRES-232) was not present on the 2.0.x and 2.1.x branches. That issue is an acceptMatchers filter bypass: resolveProxyClass is not overridden, so java.lang.reflect.Proxy objects can pass the filter. The fix, announced on 2026-06-02 as fully addressed in 2.2.8, 2.1.13, and 2.0.29, was committed only to 2.2.x. Releases before 2.0.31 and 2.1.15, including 2.0.30 and 2.1.14, remain affected. No in-the-wild exploitation is reported.
- CVE-2026-94301 tracks a missing backport of CVE-2026-47065.
- resolveProxyClass was not overridden, so Proxy objects bypass acceptMatchers.
- MINA 2.0 before 2.0.31 and 2.1 before 2.1.15 remain affected.
- The June 2026 fix was committed only on the 2.2.x branch.
- Vendors
- Apache
- Products
- Apache MINA
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-47065 | ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment | 9.8 | <1% | ||
| CVE-2026-94301 | Incomplete Fix Allows RCE in Apache MINA 2.0.x & 2.1.x | 9.8 | — |
From the original article
Posted by Emmanuel Lécharny on Sep 21 Severity: Affected versions: - Apache MINA 2. 0. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.