Apache MINA discloses unbounded decompression DoS (CVE-2026-47321) and incomplete backport of proxy filter bypass fix (CVE-2026-94301)
First merged summary for this story: added two new oss-security reports from 2026-09-21 covering CVE-2026-47321 (unbounded decompression DoS in MINA CompressionFilter) and CVE-2026-94301 (incomplete backport of the CVE-2026-47065 proxy filter bypass fix to the 2.0.x and 2.1.x branches).
Two oss-security posts on 2026-09-21 cover Apache MINA: an unbounded zlib decompression-amplification DoS in CompressionFilter, and a new CVE revealing that the fix for an acceptMatchers proxy-bypass flaw never reached the 2.0.x and 2.1.x branches.
Apache MINA is the subject of two oss-security disclosures dated 2026-09-21. CVE-2026-47321 is an unbounded decompression flaw in the mina-filter-compression component: CompressionFilter uses Zlib to inflate incoming data without limiting the output size, so a small payload can expand enough to exhaust resources (decompression-amplification denial of service). Affected versions are 2.2.0 before 2.2.8, 2.1.0 before 2.1.13, and 2.0.0 before 2.0.29, with fixes shipped in 2.2.8, 2.1.13, and 2.0.29. Separately, CVE-2026-94301 was assigned because the fix for CVE-2026-47065 (ZDRES-232) — an acceptMatchers filter bypass in which resolveProxyClass is not overridden, letting java.lang.reflect.Proxy objects pass the filter — was committed only to the 2.2.x branch despite a 2026-06-02 announcement stating it was fully addressed in 2.2.8, 2.1.13, and 2.0.29. As a result, MINA 2.0 before 2.0.31 and 2.1 before 2.1.15, including the 2.0.30 and 2.1.14 releases, remain affected by the proxy filter bypass. Neither report indicates exploitation in the wild.
- CVE-2026-47321: CompressionFilter in Apache MINA's mina-filter-compression inflates zlib data without bounding output size, enabling decompression-amplification denial of service.
- CVE-2026-47321 affected versions: 2.2.0 before 2.2.8, 2.1.0 before 2.1.13, 2.0.0 before 2.0.29; fixed in 2.2.8, 2.1.13, and 2.0.29.
- CVE-2026-94301 tracks a missing backport of the CVE-2026-47065 (ZDRES-232) fix to the 2.0.x and 2.1.x branches.
- CVE-2026-47065 is an acceptMatchers filter bypass: resolveProxyClass is not overridden, so java.lang.reflect.Proxy objects can pass the filter.
- The CVE-2026-47065 fix was announced on 2026-06-02 as fully addressed in 2.2.8, 2.1.13, and 2.0.29, but was committed only to the 2.2.x branch.
- MINA 2.0 before 2.0.31 and 2.1 before 2.1.15 — including 2.0.30 and 2.1.14 — remain affected by the proxy filter bypass.
- No in-the-wild exploitation is reported for either vulnerability.
- Both disclosures were published on oss-security on 2026-09-21.
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Coverage
oldest first · one row per article · UTC- · Sep 21, 2026
oss-securityFirst report
CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
Apache MINA CompressionFilter allows unbounded zlib inflation, enabling a decompression-amplification denial of service.
- · Sep 21, 2026
CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
Apache MINA left the CVE-2026-47065 proxy filter-bypass fix off the 2.0 and 2.1 branches.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-47065 | ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment | 9.8 | <1% | ||
| CVE-2026-47321 | Decompression bomb denial-of-service in Apache MINA CompressionFilter | 7.5 | — | ||
| CVE-2026-94301 | Incomplete Fix Allows RCE in Apache MINA 2.0.x & 2.1.x | 9.8 | — |