9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42779

CVE-2026-42779: Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.

The fix checks if the class is present in the accepted class filter before calling Class.forName().

Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.

The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42779

CVE-2026-42779:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.mina:mina-core	maven	>= 2.1.0, < 2.1.12	2.1.12
org.apache.mina:mina-core	maven	>= 2.2.0, < 2.2.7	2.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Apache MINA's AbstractIoBuffer class, specifically within the getObject() method's handling of object deserialization. This method creates an anonymous ObjectInputStream subclass to read objects from the buffer. The vulnerability lies in two overridden methods of this anonymous class: resolveClass and readClassDescriptor.

In the vulnerable versions, the resolveClass method had a code path that would call Class.forName() with a class name from the stream without first validating it against the configured acceptMatchers allowlist. This occurred when desc.forClass() returned null.

Similarly, the readClassDescriptor method would read a class name and immediately attempt to load it using Class.forName(), again without any prior validation against the allowlist.

An attacker could exploit this by crafting a serialized object stream containing a malicious class name. When IoBuffer.getObject() is called on this stream, the vulnerable methods would load and potentially instantiate the malicious class, leading to arbitrary code execution.

The patch addresses this by moving the allowlist check to the beginning of both resolveClass and readClassDescriptor, ensuring that Class.forName() is never called with a class name that has not been explicitly allowed.

Vulnerable functions

org.apache.mina.core.buffer.AbstractIoBuffer$1.resolveClass

mina-core/src/main/java/org/apache/mina/core/buffer/AbstractIoBuffer.java

The `resolveClass` method, part of an anonymous `ObjectInputStream` class within `AbstractIoBuffer.getObject()`, contained a code path where `Class.forName()` was called without prior validation against an allowlist. If `desc.forClass()` returned null, the code would proceed to load a class by name directly from the input stream, leading to deserialization of untrusted data.

org.apache.mina.core.buffer.AbstractIoBuffer$1.readClassDescriptor

mina-core/src/main/java/org/apache/mina/core/buffer/AbstractIoBuffer.java

The `readClassDescriptor` method, also within the anonymous `ObjectInputStream`, would read a class name and call `Class.forName()` without checking if the class was in the configured allowlist. This allowed an attacker to load arbitrary classes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.