This vulnerability is a deserialization of untrusted data issue (CWE-502) in Apache MINA's AbstractIoBuffer.getObject() method. The fix for a prior related vulnerability (CVE-2024-52046) was incomplete because the classname allowlist was enforced too late, after static initializers could run, potentially enabling unsafe deserialization. Versions 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6 are affected. The problem is fixed in versions 2.1.12 and 2.2.7 by applying the classname allowlist earlier in the deserialization process. This vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary code or cause denial of service by exploiting unsafe deserialization in affected Apache MINA versions. The vulnerability impacts confidentiality, integrity, and availability of affected systems. There are no known exploits in the wild at this time.

A fix is available by upgrading Apache MINA to version 2.1.12 or 2.2.7 or later, where the classname allowlist is applied earlier in the deserialization process. Users of affected versions should upgrade promptly. No other mitigation or temporary fix is indicated in the advisory.