Apache MINA Allow-List Bypass Persists in 2.0.x and 2.1.x Releases
Vulnerability Disclosure · 5 sources · Updated 2mo ago · First seen Sep 21, 2026
Apache disclosed CVE-2026-94301, confirming that MINA versions 2.0.0 through 2.0.30 and 2.1.0 through 2.1.14 remain vulnerable to the deserialization allow-list bypass previously tracked as CVE-2026-47065 / ZDRES-232. The required resolveProxyClass() override was applied only to the 2.2.x branch, allowing java.lang.reflect.Proxy objects to bypass acceptMatchers filtering in affected maintenance branches.
Earlier announcements had described MINA 2.0.29 and 2.1.13 as fully remediated, but the necessary change was not included in those branches. Organizations using affected MINA versions should upgrade to 2.0.31 or 2.1.15, which contain the missing fix, and review applications that deserialize untrusted data.
