CVE-2026-42779

[CVE catalog]

A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise. Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

May 1, 2026, 10:00:43 AM UTC

Source

[NVD] · [CVE record]

EPSS

1.23% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "mina2",
      "ecosystem": "cpe",
      "fixed_version": "2.2.1-3ubuntu0.1~esm1"
    },
    {
      "name": "libmina2-java",
      "ecosystem": "cpe",
      "fixed_version": "2.2.1-3ubuntu0.1~esm1"
    },
    {
      "name": "mina",
      "ecosystem": "cpe",
      "fixed_version": "2.1.12"
    },
    {
      "name": "mina",
      "ecosystem": "cpe",
      "fixed_version": "2.2.7"
    },
    {
      "name": "mina",
      "ranges": [
        {
          "fixed": "2.2.7",
          "introduced": "2.2.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "2.2.7",
      "provider_record_id": "NVD-CVE-2026-42779"
    }
  ]
}