Apache MINA versions 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5 contain a deserialization vulnerability in AbstractIoBuffer.resolveClass() that allows bypassing the classname allowlist, leading to arbitrary code execution. The issue is fixed in versions 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier in the deserialization process. Applications using Apache MINA that invoke IoBuffer.getObject() are affected and should upgrade to the fixed versions.