CVE-2026-42779: Apache MINA Deserialization of Untrusted Data Vulnerability
Summary
CVE-2026-42779: Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix). Affects org.apache.mina:mina-core across 2 version ranges.
>= 2.1.0, < 2.1.12
>= 2.2.0, < 2.2.7
Fixed in 2.1.12 or 2.2.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache MINA is a popular network application framework that provides a high-performance and easy-to-use API for developing network applications. It supports various protocols and is widely used for building scalable and efficient server applications. However, it has been found to be vulnerable to a deserialization issue that can lead to arbitrary code execution, particularly affecting versions 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-41635, where the method AbstractIoBuffer.resolveClass() does not properly validate class names for static classes or primitive types. This oversight allows attackers to bypass the classname allowlist, potentially leading to arbitrary code execution when applications call IoBuffer.getObject(). The severity of this vulnerability is critical, with a CVSS score of 9.8, indicating a high risk of exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.122.1.12 -
>= 2.2.0, < 2.2.72.2.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately possible, consider implementing additional validation checks in your application to ensure that only trusted classes are deserialized. However, this is not a substitute for applying the official patch.
Conclusion
In summary, CVE-2026-42779 is a critical vulnerability in Apache MINA that allows for deserialization of untrusted data, posing a significant risk of arbitrary code execution. Users are strongly advised to upgrade to the patched versions to safeguard their applications.
See every vulnerability recorded for org.apache.mina:mina-core →
FAQ
CVE-2026-42779 is a vulnerability in Apache MINA that allows for deserialization of untrusted data, potentially leading to arbitrary code execution.
Affected versions include Apache MINA 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
If immediate upgrading is not feasible, implement additional validation checks for deserialization to mitigate risks until you can apply the official patch.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mina:mina-core.
