Login Request a demo
Critical severity · published Sep 21, 2026
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the  2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Apache MINA · Apache Software Foundation
2.0.0 before 2.0.31; 2.1.0 before 2.1.15 · source: vendor
Affected product
AM
Apache MINA
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94301
lists.apache.org
https://lists.apache.org/thread/rzos6zds5x7obl8trkvznt1djw4f996p
lists.apache.org
https://lists.apache.org/thread/x4667tn5ozbvkc3wz87lhzogbfl0dczj
More from Apache MINA
9.8
CVE-2026-47065
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
9.8
CVE-2026-42778
Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
9.8
CVE-2026-42779
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
9.8
CVE-2026-41409
Apache MINA: CWE-502 Deserialization of Untrusted Data
9.8
CVE-2026-41635
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE