Mina (Apache) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 81 known versions, newest CVE from 2026-06-03. Vendor: Apache.

CVEs of Mina

• CVE-2026-47065 - CVSS 9.8 (critical), 2026-06-03: ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream…
• CVE-2026-42778 - CVSS 9.8 (critical), 2026-05-01: The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA…
• CVE-2026-42779 - CVSS 9.8 (critical), 2026-05-01: The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's…
• CVE-2026-41409 - CVSS 9.8 (critical), 2026-04-27: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was…
• CVE-2026-41635 - CVSS 9.8 (critical), 2026-04-27: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all,…
• CVE-2024-52046 - CVSS 10 (critical), 2024-12-25: The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security…
• CVE-2021-41973 - CVSS 6.5 (medium), 2021-11-01: In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP…
• CVE-2019-0231 - CVSS 7.5 (high), 2019-10-01: Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client…