Threats tagged 'ghsa-vf5j-865m-mq7c'

Apache MINA versions 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6 are vulnerable to a deserialization flaw due to an incomplete fix for CVE-2026-41635. The vulnerability arises because the classname allowlist check is bypassed for static classes or primitive types in AbstractIoBuffer.resolveClass(), allowing arbitrary code execution when IoBuffer.getObject() is called. This issue is resolved in versions 2.1.12 and 2.2.7 by applying the classname allowlist earlier in the deserialization process. Users of affected versions are advised to upgrade to the fixed releases.