Apache MINA 3.0.0 through 3.0.0-M2 unsafe deserialization (CVE-2026-118636)
JavaNativeMessageDecoder calls ObjectInputStream.readObject() with no class filter; the issue was unsupported when assigned.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #apache-mina
CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
Apache MINA left the CVE-2026-47065 proxy filter-bypass fix off the 2.0 and 2.1 branches.