Apache MINA versions 2.0.0 to 2.0.27, 2.1.0 to 2.1.10, and 2.2.0 to 2.2.5 contain a deserialization vulnerability (CWE-502) in AbstractIoBuffer.resolveClass(). The method has two branches; one branch handling static classes or primitive types does not enforce the classname allowlist, allowing untrusted data to trigger arbitrary code execution. The vulnerability affects applications that invoke IoBuffer.getObject(). The fix, introduced in versions 2.0.28, 2.1.11, and 2.2.6, ensures the classname allowlist is checked before Class.forName() is called, preventing unauthorized class loading.

Successful exploitation allows an attacker to execute arbitrary code remotely without authentication, leading to full compromise of the affected application. The CVSS score is 9.8 (critical), reflecting high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Users should upgrade Apache MINA to version 2.0.28, 2.1.11, or 2.2.6 or later where the vulnerability is fixed by enforcing the classname allowlist earlier. No other mitigations or temporary fixes are documented. Patch status is not explicitly stated in a vendor advisory but the fix is included in these versions. Users should verify upgrade paths and test accordingly.