Read the docs
TI-2026-34667 Aliases CVE-2026-47065GHSA-v3pr-hxpr-mfm8

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

Priority MEDIUM 49CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes <clinit> of SomeClass — and many real-world classes have side-effecting static initialisers Both issues have been fixed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00504 43rd percentileScored 2026-11-07
Fix Partial Apache MINA (Apache Software Foundation): 2.2.8, 2.1.13, 2.0.29org.apache.mina:mina-core (Maven): 2.2.8, 2.1.13, 2.0.29Red Hat: 11 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MINA2.2.0 to before 2.2.8; 2.1.0 to before 2.1.13; 2.0.0 to before 2.0.292.2.8, 2.1.13, 2.0.29Patch availableCNA
—org.apache.mina:mina-core (Maven)2.2.0 to before 2.2.82.2.8Patch availableGHSA-v3pr-hxpr-mfm8
—org.apache.mina:mina-core (Maven)2.1.0 to before 2.1.132.1.13Patch availableGHSA-v3pr-hxpr-mfm8
—org.apache.mina:mina-core (Maven)before 2.0.292.0.29Patch availableGHSA-v3pr-hxpr-mfm8
  • Apache MINA VendorApache Affected 2.2.0 to before 2.2.8; 2.1.0 to before 2.1.13; 2.0.0 to before 2.0.29 Fixed in 2.2.8, 2.1.13, 2.0.29 Patch available CNA
  • org.apache.mina:mina-core (Maven) Vendor— Affected 2.2.0 to before 2.2.8 Fixed in 2.2.8 Patch available GHSA-v3pr-hxpr-mfm8
  • org.apache.mina:mina-core (Maven) Vendor— Affected 2.1.0 to before 2.1.13 Fixed in 2.1.13 Patch available GHSA-v3pr-hxpr-mfm8
  • org.apache.mina:mina-core (Maven) Vendor— Affected before 2.0.29 Fixed in 2.0.29 Patch available GHSA-v3pr-hxpr-mfm8

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:mina:2.0.29:*:*:*:*:*:*:*2.0.29VulnerableApache
cpe:2.3:a:apache:mina:2.1.13:*:*:*:*:*:*:*2.1.13VulnerableApache
cpe:2.3:a:apache:mina:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableApache
  • cpe:2.3:a:apache:mina:2.0.29:*:*:*:*:*:*:* Versions 2.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:mina:2.1.13:*:*:*:*:*:*:* Versions 2.1.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:mina:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache MINA (Apache Software Foundation) Fixed in 2.2.8, 2.1.13, 2.0.29
  • Fix · GHSA-v3pr-hxpr-mfm8 org.apache.mina:mina-core (Maven) Fixed in 2.2.8 Advisory →
  • Fix · GHSA-v3pr-hxpr-mfm8 org.apache.mina:mina-core (Maven) Fixed in 2.1.13 Advisory →
  • Fix · GHSA-v3pr-hxpr-mfm8 org.apache.mina:mina-core (Maven) Fixed in 2.0.29 Advisory →

Red Hat 11 advisories

  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 8 more Red Hat advisories
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Not affected: 18 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Single Sign-On 7
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47065
  2. 2026-10-03 Alias added: GHSA-v3pr-hxpr-mfm8
  3. 2026-10-16 Affected versions changed · Red Hat

References

Advisory 2

Other 1

  • TI-2024-34922 Apache MINA: MINA applications using unbounded deserialization may allow RCE CVSS 4.0CRITICAL 10.0
  • TI-2026-31001 Deserialization of untrusted data in Apache MINA CVSS 3.1CRITICAL 9.8
  • TI-2026-31000 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) CVSS 3.1CRITICAL 9.8
  • TI-2026-30156 Deserialization of untrusted data in Apache MINA CVSS 3.1CRITICAL 9.8
  • TI-2026-30010 Apache MINA: CWE-502 Deserialization of Untrusted Data CVSS 3.1CRITICAL 9.8
  • TI-2019-00204 Apache MINA SSLFilter security Issue CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences