CVE-2026-47065: Apache MINA Critical Deserialization Allow-list Bypass Vulnerability
Summary
CVE-2026-47065: Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass. Affects org.apache.mina:mina-core across 3 version ranges.
< 2.0.29
>= 2.1.0, < 2.1.13
>= 2.2.0, < 2.2.8
Fixed in 2.0.29, 2.1.13 or 2.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache MINA is a popular network application framework that enables the development of high-performance and high-scalability applications. It provides a range of features for building network protocols and applications, including support for various transport protocols, session management, and asynchronous I/O. However, like many frameworks, it is susceptible to vulnerabilities, particularly in its serialization and deserialization processes, which can be exploited if not properly managed.
Vulnerability Detail
The vulnerability arises from the improper handling of deserialization in Apache MINA, specifically through the 'resolveProxyClass' method. When a serialized stream contains a TC_PROXYCLASSDESC marker, the default implementation of 'ObjectInputStream.resolveProxyClass' is invoked, which bypasses the allow-list of accepted classes. This allows an attacker to supply a class name from the allow-list, triggering the static initializer of that class before any instance is created. This can lead to unintended side effects and potential exploitation of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.292.0.29 -
>= 2.1.0, < 2.1.132.1.13 -
>= 2.2.0, < 2.2.82.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not accept untrusted serialized data. Implement strict validation and filtering of incoming serialized objects to mitigate the risk until the library can be updated.
Conclusion
In summary, CVE-2026-47065 is a critical vulnerability in Apache MINA that allows for deserialization allow-list bypass. It is essential to update to the latest patched versions to safeguard your applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.apache.mina:mina-core →
FAQ
CVE-2026-47065 is a critical vulnerability in Apache MINA that allows for deserialization allow-list bypass, potentially leading to unauthorized access or execution of malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Exploitation of this vulnerability can lead to the execution of arbitrary code, data leakage, and other severe impacts on application security.
To mitigate risks, update to the patched versions of Apache MINA and implement strict validation of serialized data.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mina:mina-core.
