Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-47065: Apache MINA can execute unexpected code via deserialization
CVE-2026-47065 · published 5 months ago
Summary
The MINA libraries (including debian/mina, debian/mina2, canonical/mina2, apache/org.apache.mina:mina-core, and apache/mina) allow specially crafted data to run code that was not intended to be allowed. This can let an attacker trigger the loading and execution of classes on an approved list, potentially causing harmful actions. Apply the latest security updates for MINA or upgrade to a version where the deserialization handling has been corrected.
What to do
- Update apache org.apache.mina:mina-core to version 2.2.8.
- Update apache org.apache.mina:mina-core to version 2.1.13.
- Update apache org.apache.mina:mina-core to version 2.0.29.
- Update debian mina2 to version 2.2.9-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | mina | All versions |
| Debian:12 | debian | mina | All versions |
| Debian:11 | debian | mina2 | All versions |
| Debian:12 | debian | mina2 | All versions |
| Debian:13 | debian | mina2 | All versions |
| Debian:14 | debian | mina2 |
< 2.2.9-1 Fix: upgrade to 2.2.9-1
|
| Ubuntu:22.04:LTS | canonical | mina2 | All versions |
| Ubuntu:24.04:LTS | canonical | mina2 | All versions |
| Ubuntu:25.10 | canonical | mina2 | All versions |
| Ubuntu:26.04:LTS | canonical | mina2 | All versions |
| maven | apache | org.apache.mina:mina-core |
>= 2.2.0, < 2.2.8 >= 2.1.0, < 2.1.13 < 2.0.29 Fix: upgrade to 2.2.8
|
| – | apache | mina |
2.0.29 2.1.13 2.2.8 cpe:2.3:a:apache:mina:2.0.29:*:*:*:*:*:*:* |
Original advisory text
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes <clinit> of SomeClass — and many real-world classes have side-effecting static initialisers Both issues have been fixed.
References
- https://security-tracker.debian.org/tracker/CVE-2026-47065 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-47065 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-47065 Third Party Advisory
- https://repo.maven.apache.org/maven2/org/apache/mina URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47065... Vendor Advisory
- https://github.com/advisories/GHSA-v3pr-hxpr-mfm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-47065 Vendor Advisory
- https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published3 Jun 2026
Updated4 Nov 2026
First seen3 Jun 2026
Sources
UBUNTU-CVE-2026-47065 · OSV
CVE-2026-47065 · NVD
GHSA-v3pr-hxpr-mfm8 · GHSA
CVE-2026-47065 · OSV
DEBIAN-CVE-2026-47065 · OSV
Track software like this
Free during beta