Priority MEDIUM 49
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00504 · Published 2026-06-03 · Partial fix · 2.2.8, 2.1.13 +1 CWE-502
Priority MEDIUM 50
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00657 · Published 2026-05-01 · Partial fix · 2.1.12, 2.2.7 CWE-502
Priority MEDIUM 51
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01228 · Published 2026-05-01 · Partial fix · 2.1.12, 2.2.7 CWE-502
Priority MEDIUM 49
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00433 · Published 2026-04-27 · Partial fix · 2.0.28, 2.1.11 +1 CWE-502
Priority MEDIUM 50
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to b…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00616 · Published 2026-04-27 · Partial fix · 2.0.28, 2.1.11 +1 CWE-502
Priority HIGH 70
The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.24649 · Published 2024-12-25 · Partial fix · 2.2.4, 2.1.10 +1 CWE-502
Priority LOW 36
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.04634 · Published 2021-11-01 · Partial fix · 2.1.5, 2.0.22 CWE-835
Priority LOW 37
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02125 · Published 2019-10-01 · Partial fix · 2.0.21, 2.1.1 CWE-319
THREATIST.IORead the docs