CVE Intelligence
Analysis AI-assisted

CVE-2026-41409: Apache MINA: deserialization of untrusted data (CWE-502)

CVE-2026-41409 is a CWE-502 weakness in Apache MINA AbstractIoBuffer.getObject(). According to the record, the earlier fix for CVE-2024-52046 was incomplete because the classname allowlist was applied too late. The CNA reports a CVSS score of 9.8, and the record lists fixed versions 2.0.28, 2.1.11 and 2.2.6.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Apache MINA published CVE-2026-41409, a CWE-502 deserialization weakness in AbstractIoBuffer.getObject(). According to the record, the earlier fix for CVE-2024-52046 was incomplete: the classname allowlist was applied too late, after a static initializer of a class being read might already have run. The CNA assigned a CVSS score of 9.8.

Impact

The record says the allowlist can be applied too late, so the protection intended for deserialization may not take effect in time. The CNA's CVSS score and the SSVC data in the record rate the technical impact as total. The concrete consequences depend on the application and are not detailed in the record.

Affected products and versions

  • Apache MINA from 2.0.0 up to and including 2.0.27, fixed in 2.0.28
  • Apache MINA from 2.1.0 up to and including 2.1.10, fixed in 2.1.11
  • Apache MINA from 2.2.0 up to and including 2.2.5, fixed in 2.2.6
  • Applications that call IoBuffer.getObject() are the ones described as affected.

Exploitation status

The CISA KEV data in the record does not list this CVE, so no active exploitation is stated. No confirmed exploitation appears in the sources consulted. The SSVC data lists exploitation as none and automatable as yes, and the record gives an EPSS probability of 0.00752.

Remediation and mitigation

  • Upgrade Apache MINA to 2.0.28, 2.1.11 or 2.2.6, matching the branch in use, as recommended by the advisory.
  • Inventory applications and dependency manifests that include Apache MINA and identify whether they call IoBuffer.getObject().
  • The record does not describe other workarounds. Limiting untrusted input reaching object deserialization paths is a general defensive measure (inference).

Detection guidance

  • Review software inventories and build artifacts for Apache MINA versions in the affected ranges.
  • Monitor application logs for unexpected deserialization errors or unusual class loading in components that use this API (inference, based on general practice).

Limitations of the available information

  • The fixes list in the record is empty, so the fixed versions above come from the description text.
  • The record does not describe the exploitation mechanics or a proof of concept, and it does not confirm whether versions outside the listed branches are affected.
  • Whether a given deployment is exploitable depends on its use of IoBuffer.getObject(), which the record does not evaluate.

Frequently asked questions

Which Apache MINA versions are affected by CVE-2026-41409?

According to the record, versions from 2.0.0 up to and including 2.0.27, from 2.1.0 up to and including 2.1.10, and from 2.2.0 up to and including 2.2.5 are affected.

Which versions fix this issue?

The description states that the problem is resolved in Apache MINA 2.0.28, 2.1.11 and 2.2.6, by applying the classname allowlist earlier.

Is this CVE known to be exploited in the wild?

No. The CISA KEV data in the record does not list this CVE, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.