Loading story…
Apache disclosed CVE-2026-94301, confirming that MINA versions 2.0.0 through 2.0.30 and 2.1.0 through 2.1.14 remain vulnerable to the deserialization allow-list bypass previously tracked as CVE-2026-47065 / ZDRES-232. The required resolveProxyClass() override was applied only to the 2.2.x branch, allowing java.lang.reflect.Proxy objects to bypass acceptMatchers filtering in affected maintenance branches.
Earlier announcements had described MINA 2.0.29 and 2.1.13 as fully remediated, but the necessary change was not included in those branches. Organizations using affected MINA versions should upgrade to 2.0.31 or 2.1.15, which contain the missing fix, and review applications that deserialize untrusted data.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Apache MINA disclosed that the resolveProxyClass() fix for CVE-2026-47065 had been committed only to the 2.2.x branch, leaving versions 2.0.0 through 2.0.30 and 2.1.0 through 2.1.14 vulnerable. The issue was assigned CVE-2026-94301; MINA identified 2.0.31 and 2.1.15 as the fixed releases.
Apache MINA announced bug-fix releases 2.1.15 and 2.0.31. The release announcement said the CVE-2026-47065 fix had not been backported to these releases and advised users of older versions to upgrade.
Apache MINA released CVE-2026-47065/ZDRES-232 to address a resolveProxyClass-related acceptMatchers allow-list bypass involving java.lang.reflect.Proxy objects. MINA stated that versions 2.2.8, 2.1.13, and 2.0.29 fully addressed the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcelists.apache.org
Open sourcelists.apache.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-48827**, a path traversal flaw in the `org.apache.sshd:sshd-git` bundle of Apache MINA SSHD that lets an SSH-authenticated user escape the configured Git root by supplying repository paths containing traversal sequences such as `../`. The issue affects `sshd-git` versions `2.0.0` through `2.17.1` and `3.0.0-M1` through `3.0.0-M3`, impacting `git-upload-pack`, `git-receive-pack`, and related operations. Successful exploitation can expose arbitrary Git repositories on the server filesystem and, in some cases, allow unauthorized writes outside the intended root. Apache fixed the bug in versions `2.18.0` and `3.0.0-M4` by adding centralized path validation, and noted that deployments using Apache MINA SSHD without the non-default `sshd-git` module are not affected. Apache also disclosed **CVE-2026-35563** in the Apache Directory LDAP API client, where versions `2.0.0` through `2.1.7` failed to verify whether a TLS server certificate matched the intended LDAP hostname. Because the client would accept a trusted certificate issued for an unrelated host, an attacker with man-in-the-middle network access could impersonate the LDAP server and fully compromise the connection. The flaw is tracked as `CWE-297`, and Apache said hostname verification is now enforced in a newer LDAP API release. The disclosures highlight two separate Apache security fixes affecting repository isolation in SSH-based Git services and certificate validation in LDAP client connections.
Jun 29, 2026
Apache disclosed **CVE-2026-56452**, a moderate-severity path traversal flaw in the `sshd-scp` component of **Apache MINA SSHD** that lets a malicious SCP sender write files to attacker-controlled locations during file reception. The issue stems from improper validation of filenames supplied in SCP `C` or `D` commands, creating a risk for applications that use Apache MINA SSHD to receive files over SCP. The vulnerability affects `org.apache.sshd:sshd-scp` through **2.18.0** and **3.0.0-M1** through **3.0.0-M4**. Apache said applications using Apache MINA SSHD **2.0.0 or later** are impacted only if they rely on `sshd-scp` for inbound file transfers, and it released fixes in **2.19.0** and **3.0.0-M5**. The flaw was reported by **Unbbal**.
Jul 20, 2026
Apache disclosed three unsafe deserialization vulnerabilities in **Apache Camel** that can lead to remote code execution in deployments using `camel-mina`, JMS-related components, and `camel-infinispan`. **CVE-2026-40473** affects `camel-mina`, where `MinaConverter.toObjectInput()` wraps network-supplied TCP or UDP data in `java.io.ObjectInputStream` without `ObjectInputFilter` or class-loading restrictions; a crafted serialized Java object can execute during `readObject()`. **CVE-2026-40860** affects `camel-jms`, `camel-sjms`, `camel-sjms2`, and `camel-amqp`, where Camel deserializes JMS `ObjectMessage` payloads through `ObjectMessage.getObject()` with the default `mapJmsMessage` option enabled and without filtering or allow/deny lists, allowing an attacker who can publish to a consumed queue or topic to trigger code execution if a gadget chain is present. Apache also disclosed **CVE-2026-40858** in `camel-infinispan`, where the ProtoStream-based remote aggregation repository deserializes data from a remote Infinispan cache using `java.io.ObjectInputStream` without an input filter; an attacker able to write to the cache can inject a malicious serialized object that executes during normal `get` or `recover` operations. The affected versions span multiple Camel release lines, including `3.0.0` and later for the JMS issue, `3.0.0` and later for `camel-mina`, and `4.0.0` and later for `camel-infinispan`, with fixes released in **4.20.0** and backported to supported streams including **4.14.6/4.14.7** and **4.18.2**. Apache tracks the flaws as `CAMEL-23319`, `CAMEL-23321`, and `CAMEL-23322`, with reports credited to researchers from **Securin** and **Innora Pte. Ltd.**
Jun 29, 2026