SB20260428219 - Multiple vulnerabilities in Apache MINA

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-41635)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper access control in AbstractIoBuffer.resolveClass() when deserializing objects via IoBuffer.getObject(). A remote attacker can send a specially crafted serialized object to execute arbitrary code.

The issue affects the branch for static classes or primitive types, which bypasses the classname allowlist.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41409)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in AbstractIoBuffer.getObject() when deserializing untrusted objects. A remote attacker can supply a crafted serialized object to execute arbitrary code.

Only applications that call IoBuffer.getObject() are affected.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=oyo3f1jw0tp5lnlh0rzn5dxh3jvkkz7q
• https://lists.apache.org/api/email.lua?id=gpbs5q1vomg85j2jfd0nnp9tjkjywk76