CVE-2026-41635: Apache MINA Deserialization of Untrusted Data Vulnerability
Summary
CVE-2026-41635: Apache MINA vulnerable to Deserialization of Untrusted Data. Affects org.apache.mina:mina-core across 3 version ranges.
>= 2.0.0, < 2.0.28
>= 2.1.0, < 2.1.11
>= 2.2.0, < 2.2.6
Fixed in 2.0.28, 2.1.11 or 2.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache MINA is a popular network application framework that enables developers to build high-performance and scalable network applications in Java. It provides a simple and flexible API for handling various network protocols and is widely used in applications requiring asynchronous communication. However, a critical vulnerability has been identified in its handling of object deserialization, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the method AbstractIoBuffer.resolveClass() in Apache MINA, which contains branches that do not adequately validate class names. Specifically, for static classes or primitive types, the method bypasses the classname allowlist, allowing attackers to execute arbitrary code. This flaw can lead to unauthorized access and manipulation of the application, potentially compromising sensitive data and system integrity.
How To Fix
Latest published version: 3.0.0-M2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.282.0.28 -
>= 2.1.0, < 2.1.112.1.11 -
>= 2.2.0, < 2.2.62.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, if upgrading is not immediately feasible, consider implementing strict input validation and sanitization on any data being deserialized. This can help mitigate the risk of executing untrusted data, although it is not a complete solution.
Conclusion
CVE-2026-41635 is a critical vulnerability in Apache MINA that allows for the deserialization of untrusted data, leading to potential arbitrary code execution. It is crucial for users of affected versions to upgrade to the patched releases to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for org.apache.mina:mina-core →
FAQ
The vulnerability allows attackers to execute arbitrary code through untrusted data deserialization, potentially leading to unauthorized access and data manipulation.
Affected versions include Apache MINA 2.0.0 to 2.0.27, 2.1.0 to 2.1.10, and 2.2.0 to 2.2.5.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can help identify if your application is affected by this vulnerability.
The CVSS score for CVE-2026-41635 is 9.8, indicating a critical level of severity.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mina:mina-core.
