Loading vulnerability…
Apache MINA deserialization allow-list bypass due to incomplete fix
CVE-2026-94301 is an incomplete remediation vulnerability affecting Apache MINA 2.0.0 through 2.0.30 and 2.1.0 through 2.1.14. The resolveProxyClass() override intended to address CVE-2026-47065 was applied only to the 2.2.x branch, leaving the 2.0.x and 2.1.x maintenance branches vulnerable. Although versions 2.0.29 and 2.1.13 were previously announced as fixed, they lack the required override. Consequently, java.lang.reflect.Proxy classes can bypass acceptMatchers allow-list filtering, undermining intended deserialization restrictions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can bypass class-acceptance restrictions during deserialization, permitting processing of proxy classes that the acceptMatchers allow-list was intended to exclude. This defeats a security control against unsafe deserialization. Specific downstream outcomes, such as arbitrary code execution or data compromise, are not independently established for this vulnerability.
If you can’t patch tonight, do this now.
Avoid deserializing attacker-controlled data and restrict untrusted serialized input until a corrected release is deployed. Do not rely on acceptMatchers filtering in affected releases as an effective security boundary. Limit exposure of affected services pending remediation.
Patch, then assume compromise.
Upgrade affected Apache MINA 2.0.x installations to 2.0.31 or later and affected 2.1.x installations to 2.1.15 or later. Alternatively, migrate to Apache MINA 2.2.8 or a later 2.2.x release containing the resolveProxyClass() override. Versions 2.0.29, 2.0.30, 2.1.13, and 2.1.14 do not contain the required fix.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.