CVE-2026-41635: Apache MINA: Classname Filter Bypass in IoBuffer Deserialization
A branch of AbstractIoBuffer.resolveClass() in Apache MINA does not check the class against the classname allowlist, which enables code execution through deserialization. The vendor fixed the issue in versions 2.0.28, 2.1.11 and 2.2.6. The advisory states that applications calling IoBuffer.getObject() are affected, and no confirmed exploitation appears in the sources consulted.
Overview
The record describes a flaw in the resolveClass() method of AbstractIoBuffer in Apache MINA. One of its two branches, used for static classes or primitive types, does not check the class against the classname allowlist. The vendor's fix applies the accepted class filter before Class.forName() is called.
Impact
The weakness is classified as CWE-502, Deserialization of Untrusted Data. The advisory text says the bypass allows arbitrary code to be executed. The recorded CVSS base score is 9.8 (critical), with network attack vector, low complexity, no privileges and no user interaction required, and high impact to confidentiality, integrity and availability.
Affected products and versions
The sources list the following affected ranges:
- From 2.0.0 up to and including 2.0.27
- From 2.1.0 up to and including 2.1.10
- From 2.2.0 up to and including 2.2.5
The fixed versions named by the vendor are 2.0.28, 2.1.11 and 2.2.6. The advisory states that applications using Apache MINA that call IoBuffer.getObject() are the affected ones. The record's fixes field is empty, so the fixed versions come from the vendor text and the affected version list.
Exploitation status
The CISA KEV catalog does not list this CVE. No confirmed active exploitation appears in the sources consulted. The SSVC record shows exploitation as none and automatable as yes. The EPSS record gives a probability of 0.00817 and a percentile of 0.56713, with the date recorded as 2026-10-23.
Remediation and mitigation
- Upgrade to Apache MINA 2.0.28 or later in the 2.0 line, 2.1.11 or later in the 2.1 line, or 2.2.6 or later in the 2.2 line, as the vendor recommends.
- Inventory all applications and libraries that bundle Apache MINA, including transitive dependencies, and prioritize those that call IoBuffer.getObject().
- Until patching is complete, limit network exposure of services that use Apache MINA and avoid deserializing data from untrusted sources.
Detection guidance
- Review software bills of materials and dependency manifests for Apache MINA versions within the listed affected ranges.
- Monitor application logs for unexpected deserialization errors or class-loading activity originating from network-facing endpoints.
- Verify the deployed version after patching to confirm the fixed release is in use.
Limitations of the available information
The available record does not include vendor proof-of-concept details, the exact conditions for exploitation in deployed systems, or any observed attack activity. The EPSS date is later than the publication date, so its meaning should be checked against the source data. Descriptions of impact are taken from the advisory text and the CVSS data in the record.
Frequently asked questions
Which Apache MINA versions are affected by CVE-2026-41635?
The sources list the ranges from 2.0.0 up to and including 2.0.27, from 2.1.0 up to and including 2.1.10, and from 2.2.0 up to and including 2.2.5.
What is the fixed version?
The vendor states the problem is resolved in Apache MINA 2.0.28, 2.1.11 and 2.2.6, which apply the classname allowlist earlier.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list this CVE, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.