CVE-2026-42779: Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub2 May
5. Not established: not seen

DescriptionNVD

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.

Exploitation

Possible (1 to 10%). EPSS between 1% and 10%.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Deserialization of Untrusted Data · Deserialization and Object Injection

Vendor

Apache Software Foundation

Published

May 2026

Band

Possible (1 to 10%), May 2026

1. 2 May
   PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

• NVD entrynvd.nist.gov
• Vendor advisorylists.apache.org
• CVE recordcve.org