This vulnerability concerns Apache MINA's deserialization process where the resolveProxyClass method was not overridden, allowing attackers to bypass accept-list filters by supplying serialized streams containing TC_PROXYCLASSDESC markers for java.lang.reflect.Proxy. The default ObjectInputStream.resolveProxyClass implementation uses Class.forName on each interface name, constructing proxy classes without enforcing the accept-list. Additionally, deserializing allow-listed classes triggers their static initializers before instance construction, which can execute side-effecting code. Both issues have been fully addressed by Apache, though no explicit patch version or advisory is provided.

Successful exploitation could allow an unauthenticated remote attacker to bypass deserialization accept-list filters and trigger static initializers of classes, potentially leading to arbitrary code execution, complete confidentiality, integrity, and availability compromise of affected systems. The CVSS 3.1 score is 9.8 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

The vendor has fully addressed these issues. However, no explicit patch or official fix version is provided in the available data. Users should consult the Apache Software Foundation advisories or official Apache MINA project communications for the latest patch or update information and apply any available updates promptly. Until then, consider restricting deserialization of untrusted data and monitoring for suspicious activity related to deserialization.