CVE-2026-41409
Deserialization Flaw in Apache MINA IoBuffer Causes Security Risk
Publication date: 2026-04-27
Last updated on: 2026-04-29
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | mina | From 2.0.0 (inc) to 2.0.28 (exc) |
| apache | mina | From 2.1.0 (inc) to 2.1.11 (exc) |
| apache | mina | From 2.2.0 (inc) to 2.2.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is related to Apache MINA's AbstractIoBuffer.getObject() method. The fix for a previous vulnerability (CVE-2024-52046) was incomplete because the classname allowlist, which restricts which classes can be deserialized, was applied too late. This means that a static initializer in a class to be deserialized might have already executed before the allowlist was enforced, potentially allowing unsafe deserialization.
Affected versions include Apache MINA 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5. The issue is fixed in versions 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier in the deserialization process.
How can this vulnerability impact me? :
This vulnerability can have a severe impact because it allows potentially unsafe deserialization of classes in Apache MINA applications that use IoBuffer.getObject().
- An attacker could exploit this to execute arbitrary code remotely.
- It can lead to full compromise of the affected system, including confidentiality, integrity, and availability.
The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, applications using Apache MINA that call IoBuffer.getObject() should upgrade to fixed versions where the issue is resolved.
- Upgrade Apache MINA to version 2.0.28 or later if using the 2.0.x branch.
- Upgrade Apache MINA to version 2.1.11 or later if using the 2.1.x branch.
- Upgrade Apache MINA to version 2.2.6 or later if using the 2.2.x branch.