Apache MINA discloses unbounded decompression DoS (CVE-2026-47321) and incomplete backport of proxy filter bypass fix (CVE-2026-94301)

Two oss-security posts on 2026-09-21 cover Apache MINA: an unbounded zlib decompression-amplification DoS in CompressionFilter, and a new CVE revealing that the fix for an acceptMatchers proxy-bypass flaw never reached the 2.0.x and 2.1.x branches.

Apache MINA is the subject of two oss-security disclosures dated 2026-09-21. CVE-2026-47321 is an unbounded decompression flaw in the mina-filter-compression component: CompressionFilter uses Zlib to inflate incoming data without limiting the output size, so a small payload can expand enough to exhaust resources (decompression-amplification denial of service). Affected versions are 2.2.0 before 2.2.8, 2.1.0 before 2.1.13, and 2.0.0 before 2.0.29, with fixes shipped in 2.2.8, 2.1.13, and 2.0.29. Separately, CVE-2026-94301 was assigned because the fix for CVE-2026-47065 (ZDRES-232) — an acceptMatchers filter bypass in which resolveProxyClass is not overridden, letting java.lang.reflect.Proxy objects pass the filter — was committed only to the 2.2.x branch despite a 2026-06-02 announcement stating it was fully addressed in 2.2.8, 2.1.13, and 2.0.29. As a result, MINA 2.0 before 2.0.31 and 2.1 before 2.1.15, including the 2.0.30 and 2.1.14 releases, remain affected by the proxy filter bypass. Neither report indicates exploitation in the wild.

• CVE-2026-47321: CompressionFilter in Apache MINA's mina-filter-compression inflates zlib data without bounding output size, enabling decompression-amplification denial of service.
• CVE-2026-47321 affected versions: 2.2.0 before 2.2.8, 2.1.0 before 2.1.13, 2.0.0 before 2.0.29; fixed in 2.2.8, 2.1.13, and 2.0.29.
• CVE-2026-94301 tracks a missing backport of the CVE-2026-47065 (ZDRES-232) fix to the 2.0.x and 2.1.x branches.
• CVE-2026-47065 is an acceptMatchers filter bypass: resolveProxyClass is not overridden, so java.lang.reflect.Proxy objects can pass the filter.
• The CVE-2026-47065 fix was announced on 2026-06-02 as fully addressed in 2.2.8, 2.1.13, and 2.0.29, but was committed only to the 2.2.x branch.
• MINA 2.0 before 2.0.31 and 2.1 before 2.1.15 — including 2.0.30 and 2.1.14 — remain affected by the proxy filter bypass.
• No in-the-wild exploitation is reported for either vulnerability.
• Both disclosures were published on oss-security on 2026-09-21.