Vulnerability details

CVE-2026-94301

Apache Software Foundation Apache MINA

Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

CVSS 3.1

9.8Critical

Official description

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (apache)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Apache Software Foundation	Apache MINA	2.0.0 ≤ v < 2.0.31	CVEProject cvelistV5 (CNA)
Apache Software Foundation	Apache MINA	2.1.0 ≤ v < 2.1.15	CVEProject cvelistV5 (CNA)

References and advisories

https://lists.apache.org/thread/rzos6zds5x7obl8trkvznt1djw4f996p mailing-list
https://lists.apache.org/thread/x4667tn5ozbvkc3wz87lhzogbfl0dczj vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-21
Last updated: 2026-09-22
State: Published
Assigner (CNA): apache

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

33.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-502
Deserialization of untrusted data