CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

CVE-2026-47321 is an unauthenticated remote denial-of-service vulnerability in the CompressionFilter class of the Apache MINA network application framework. The filter uses ZLib to inflate incoming compressed data but does not limit the resulting decompressed size, so an attacker can send a small, highly compressed payload (a 'zip bomb' with a compression ratio exceeding 1,000x) that expands to exhaust application memory and crash the service. Any application using MINA's CompressionFilter on a network-facing endpoint is affected until the developer configures a size limit. The fix introduces a configurable maximum decompressed size and compression-ratio limit, but applications must explicitly pass these limits via new constructor parameters or the fluent API. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and there are no confirmed reports of in-the-wild exploitation.