Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.
The fix checks if the class is present in the accepted class filter before calling Class.forName().
Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and
2.2.0 <= 2.2.5.
The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by
applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/27/4 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
29 Apr 2026, 19:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache mina |
|
| References | () https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/27/4 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:* |
27 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-27 09:16
Updated : 2026-04-29 19:08
NVD link : CVE-2026-41635
Mitre link : CVE-2026-41635
CVE.ORG link : CVE-2026-41635
JSON object : View
Products Affected
apache
- mina
CWE
CWE-502
Deserialization of Untrusted Data