CVE-2026-42778: Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
Last updated 18 June 2026
Other sources
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.
The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.1.0 <= 2.1.110, and 2.2.0 <= 2.2.6.
The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
— NVD
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.1.0 = 2.1.11, and 2.2.0 = 2.2.6.
The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.1.0 = 2.1.110, and 2.2.0 = 2.2.6.
The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache MINAto a version that resolves this vulnerability.Fixed in 2.1.12 - Upgrade
Upgrade
Apache MINAto a version that resolves this vulnerability.Fixed in 2.2.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-52046 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-41409
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42778?
CVE-2026-42778 is rated as a high-severity vulnerability due to its potential for remote code execution via deserialization of untrusted data.
Which versions of Apache MINA are affected by CVE-2026-42778?
CVE-2026-42778 affects Apache MINA versions 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6.
How do I fix CVE-2026-42778?
To fix CVE-2026-42778, upgrade Apache MINA to version 2.1.12 or later for the 2.1.X branch and 2.2.7 or later for the 2.2.X branch.
What type of vulnerability is CVE-2026-42778?
CVE-2026-42778 is a deserialization of untrusted data vulnerability, classified under CWE-502.
What impact does CVE-2026-42778 have on applications using Apache MINA?
The impact of CVE-2026-42778 allows attackers to potentially execute arbitrary code on the server running vulnerable versions of Apache MINA.