CVE-2026-42779

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42779
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42779.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-42779
Aliases
Downstream
Related
Published
2026-05-01T10:00:43.712Z
Modified
2026-05-18T06:00:11.639341141Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
Details

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.

The fix checks if the class is present in the accepted class filter before calling Class.forName().

Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.

The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.2.X"
                },
                {
                    "last_affected": "2.2.6"
                },
                {
                    "introduced": "2.1.X"
                },
                {
                    "last_affected": "2.1.11"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42779.json"
}
References

Affected packages

Git / github.com/apache/mina

Affected ranges

Type
GIT
Repo
https://github.com/apache/mina
Events
Introduced
d595254cb8c254204d794457d42219321a6a2306
Fixed
ddb1495e8483e7dc6f257419a356b87cb3929912
Introduced
079d4592943ff892504e11a331c4f6601b7a04ec
Fixed
a2fa7504ddff446a6cb93862f4517a6ca74b07cd
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.1.12"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.7"
        }
    ]
}

Affected versions

2.*
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.2
2.2.3
2.2.4
2.2.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42779.json"