CVE-2026-42778
Incomplete Deserialization Classname Allowlist in Apache MINA
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | mina | From 2.1.0 (inc) to 2.1.12 (exc) |
| apache | mina | From 2.2.0 (inc) to 2.2.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability is due to an incomplete fix for a previous issue (CVE-2024-52046) in Apache MINA's AbstractIoBuffer.getObject() method. The problem arises because the classname allowlist, which restricts which classes can be deserialized, was applied too late—after a static initializer in a class to be read might have already executed. This means that potentially unsafe classes could be deserialized before the allowlist check is enforced.
Affected versions include Apache MINA 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6. The issue is fixed in versions 2.1.12 and 2.2.7 by applying the classname allowlist earlier in the deserialization process.
Applications using Apache MINA that call IoBuffer.getObject() are impacted and are advised to upgrade to the fixed versions.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows potentially unsafe deserialization of classes before proper validation. Given the CVSS score of 9.8, it indicates a critical risk with network attack vector, low complexity, no privileges required, and no user interaction needed.
The impact includes full confidentiality, integrity, and availability compromise (C:H/I:H/A:H), meaning an attacker could execute arbitrary code, cause denial of service, or access sensitive data by exploiting this flaw in Apache MINA.
What immediate steps should I take to mitigate this vulnerability?
Applications using Apache MINA that call IoBuffer.getObject() are advised to upgrade to versions 2.1.12 or 2.2.7 or later.
These versions apply the classname allowlist earlier to properly prevent unsafe deserialization.