Apache Software Foundation Apache MINA

• CVE-2026-118636 Critical 9.8 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder 0.6%
• CVE-2026-94301 Critical 9.8 Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 0.4%
• CVE-2026-47321 High 7.5 Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate 0.5%
• CVE-2026-47065 Critical 9.8 Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 0.5%
• CVE-2026-42778 Critical 9.8 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) 0.7%
• CVE-2026-42779 Critical 9.8 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2) 1.2%
• CVE-2026-41409 Critical 9.8 Apache MINA: CWE-502 Deserialization of Untrusted Data 0.4%
• CVE-2026-41635 Critical 9.8 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE 0.6%
• CVE-2024-52046 Critical 10.0 Apache MINA: MINA applications using unbounded deserialization may allow RCE 24.4%
• CVE-2021-41973 Unrated Apache MINA HTTP listener DOS 4.6%