Apache MINA allowlist bypass turns deserialization into network RCE

TL;DR - AbstractIoBuffer.resolveClass() has a branch for static classes and primitive types that skips the accepted-class allowlist entirely. Any MINA service calling IoBuffer.getObject() on untrusted bytes is exposed to unauthenticated RCE. CVSS 9.8. Upgrade to 2.0.28, 2.1.11, or 2.2.6.

What happened

Apache MINA (org.apache.mina:mina-core) is a Java network application framework used to build protocol servers and clients. CVE-2026-41635 is a deserialization allowlist bypass.

The framework exposes IoBuffer.getObject() to deserialize objects from the wire. Internally, AbstractIoBuffer.resolveClass() handles class resolution with two branches. One branch - hit when resolving static classes or primitive types - does not check the class against the accepted-class filter at all. That gap is enough to feed attacker-controlled class names past the allowlist and reach readObject(). The result is unauthenticated remote code execution.

This is the canonical deserialization failure mode: a class filter that looks solid until one code path quietly avoids it. "Safe" deserialization gates drift, then readObject() becomes a remote execution primitive again. If you have any MINA-based service deserializing untrusted bytes, treat this as high priority.

Who is impacted

• Applications that depend on org.apache.mina:mina-core and call IoBuffer.getObject().
• Deployments on any of the affected release lines:
  • MINA 2.0.0 through 2.0.27
  • MINA 2.1.0 through 2.1.10
  • MINA 2.2.0 through 2.2.5

What to do now

• Upgrade to the fixed release for your branch: 2.0.28, 2.1.11, or 2.2.6.

  "Applications using Apache MINA are advised to upgrade."

• Inventory every place MINA appears - build manifests, lockfiles, container images, transitive dependencies - and confirm whether any code path calls IoBuffer.getObject().
• Treat this like any deserialization-RCE event: identify which endpoints accept attacker-controlled bytes that reach MINA deserialization, and prioritise patch rollout for those services first.
• If you suspect exposure, review inbound traffic logs for anomalous payloads on MINA-served ports and rotate credentials accessible from affected services.