CVE-2026-41635

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.0.0 through 2.0.27 Apache MINA versions 2.1.0 through 2.1.10 Apache MINA versions 2.2.0 through 2.2.5

Description A flaw in the resolveClass() function of AbstractIoBuffer allows a bypass of the classname allowlist for static classes or primitive types. This occurs because one of the execution branches fails to validate the class, enabling unsafe deserialization when applications call IoBuffer.getObject(). This can lead to remote code execution.

Recommendations Upgrade to version 2.0.28 for versions 2.0.0 through 2.0.27. Upgrade to version 2.1.11 for versions 2.1.0 through 2.1.10. Upgrade to version 2.2.6 for versions 2.2.0 through 2.2.5.