Critical severity · published May 1, 2026
CVE-2026-42778
Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.
The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by
applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.1.0 <= 2.1.110, and 2.2.0 <= 2.2.6.
The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by
applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Apache MINA · Apache Software Foundation
2.2.X through 2.2.6; 2.1.X through 2.1.11 · source: vendor
MI
Mina · Apache
2.1.0 before 2.1.12; 2.2.0 before 2.2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42778
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42778
Mailing List
https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0
More from Apache MINA
9.8
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
9.8
CVE-2026-47065
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
9.8
CVE-2026-42779
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
9.8
CVE-2026-41409
Apache MINA: CWE-502 Deserialization of Untrusted Data
9.8
CVE-2026-41635
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE