CVE-2026-42778 - Vulnerability Analysis

Overview

Apache MINA 2.1.0 <= 2.1.11 and 2.2.0 <= 2.2.6 contain an insecure deserialization caused by late application of classname allowlist in AbstractIoBuffer.getObject(), letting attackers execute code via deserialization, exploit requires calling IoBuffer.getObject().

Severity & Score

Impact

Attackers can execute arbitrary code via deserialization, potentially leading to full system compromise.

Mitigation

Upgrade to Apache MINA 2.1.12 or 2.2.7 or later.

References

• https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner