CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
Apache MINA CompressionFilter allows unbounded zlib inflation, enabling a decompression-amplification denial of service.
CVE-2026-47321 is an unbounded decompression flaw in Apache MINA's mina-filter-compression component. CompressionFilter uses Zlib to inflate incoming data but does not limit the resulting size, allowing a decompression-amplification denial of service. Affected versions are 2.2.0 before 2.2.8, 2.1.0 before 2.1.13, and 2.0.0 before 2.0.29. The oss-security post does not report exploitation in the wild.
- CompressionFilter inflates zlib data without bounding the output size.
- A small payload can expand enough to exhaust resources.
- Fixed in MINA 2.2.8, 2.1.13, and 2.0.29.
- No in-the-wild exploitation is reported.
- CVEs
- CVE-2026-47321
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-47321 | Decompression bomb denial-of-service in Apache MINA CompressionFilter | 7.5 | — |
From the original article
Posted by Emmanuel Lécharny on Sep 21 Severity: Affected versions: - Apache MINA (org. apache. mina:mina-filter-compression) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.