CVE-2026-94301
Received Received - Intake

Proxy Class Bypass in Apache MINA

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Apache Software Foundation

Description
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the  2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94301
EUVD
EUVD-2026-83946

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache mina 2.2.8
apache mina 2.1.13
apache mina to 2.0.30 (inc)
apache mina to 2.1.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94301 is a bypass vulnerability in Apache MINA versions 2.0.29, 2.0.30, 2.1.13, 2.1.14 and earlier. The issue involves a missing fix for CVE-2026-47065 where the resolveProxyClass() method was not overridden in the 2.0.X and 2.1.X branches. This allows an allow-list bypass via java.lang.reflect.Proxy, enabling attackers to bypass security filters.

Detection Guidance

This vulnerability affects Apache MINA versions 2.0.29, 2.1.13, and later releases on the 2.0.X and 2.1.X branches due to a missing fix. To detect it, check the installed MINA version and verify if the resolveProxyClass() method is overridden in the Proxy class. Use commands like 'find / -name "mina-core*.jar" 2>/dev/null' to locate MINA JAR files and inspect their version metadata.

Impact Analysis

This vulnerability allows remote attackers to bypass intended security filters, potentially leading to unauthorized access to sensitive data or systems. The high CVSS score (9.8) indicates a critical risk with potential for complete system compromise, data theft, or service disruption if exploited.

Compliance Impact

This vulnerability allows remote code execution and unauthorized data access due to a proxy class bypass, which could lead to violations of data protection regulations like GDPR or HIPAA by exposing sensitive information or allowing unauthorized modifications.

Mitigation Strategies

Upgrade to Apache MINA versions 2.2.8 or later. If using 2.0.X or 2.1.X branches, upgrade to 2.0.31 or 2.1.15 when available. Remove affected versions from systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart