CVE-2026-42779

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.1.0 through 2.1.11 Apache MINA versions 2.2.0 through 2.2.6

Description An insecure deserialization flaw exists in the Apache MINA network application framework. The resolveClass() function within AbstractIoBuffer contains a logic branch for static classes or primitive types that fails to validate the class against the classname allowlist. This bypass allows a remote attacker to execute arbitrary code on the server without authentication when the application calls the getObject() function of IoBuffer. This issue impacts the confidentiality, integrity, and availability of the protected information.

Recommendations Upgrade Apache MINA versions 2.1.0 through 2.1.11 to version 2.1.12. Upgrade Apache MINA versions 2.2.0 through 2.2.6 to version 2.2.7.