Quick Look: Apache MINA CVE-2026-41635 — Critical Deserialization Allowlist Bypass Leading to Remote Code Execution

Introduction

A deserialization allowlist bypass in Apache MINA's core buffer handling lets unauthenticated attackers achieve remote code execution by loading arbitrary Java classes through an unguarded code path. It has a CVSS score of 9.8 and spans three major release lines of a foundational Java networking framework. Any team running applications built on MINA should address it immediately.

Apache MINA is a network application framework that provides an abstract, event-driven, asynchronous API over various transports via Java NIO. It is widely used to build high-performance and highly scalable network applications, and it is the foundational socket library under numerous downstream projects. A vulnerability in its core components can therefore cascade across the broader Java ecosystem.

Technical Information

The vulnerability is in the AbstractIoBuffer.resolveClass() method in the Apache MINA core library. Java object deserialization invokes this method to resolve class names to their corresponding Class objects. The method has two execution branches: one for general classes and one for static classes or primitive types.

The branch for static classes or primitive types skips the accepted class filter check entirely. When an attacker crafts a serialized object that triggers this branch, the method calls Class.forName() directly, with no validation against the configured allowlist. On that path, the control meant to restrict which classes can be deserialized does nothing.

Attack Flow

Exploitation follows these steps:

1. An application built on Apache MINA uses the ObjectSerializationDecoder, a protocol decoder that deserializes Java objects from the network stream, to handle incoming network data.

2. The ObjectSerializationDecoder internally calls IoBuffer.getObject(ClassLoader) to read a Java object from the buffer.

3. During deserialization, AbstractIoBuffer.resolveClass() is invoked to resolve class names found in the serialized data.

4. The attacker crafts a malicious serialized payload that causes the resolution to take the branch for static classes or primitive types.

5. Because this branch does not check the class against the acceptMatchers filter, the attacker's arbitrary class is loaded via Class.forName() without restriction.

6. Through well-known Java deserialization gadget chains, this unrestricted class loading leads to arbitrary code execution on the target system.

The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the severity. The attack is network accessible, requires no privileges or user interaction, and has low complexity. All three impact dimensions (confidentiality, integrity, availability) are rated high.

The Fix

Versions 2.0.28, 2.1.11, and 2.2.6 move the classname allowlist check earlier in the execution flow. The patched code verifies that the class is present in the accepted class filter before calling Class.forName(), so both branches of resolveClass() go through the same filtering logic.

Affected Systems and Versions

The vulnerability affects three major release lines of the Apache MINA core library:

The affected applications are those that call IoBuffer.getObject() or use the ObjectSerializationDecoder class to deserialize Java objects from network streams. Applications that do not use these serialization components are not directly exposed.

Vendor Security History

Apache MINA has had a deserialization vulnerability in this component before. CVE-2024-52046 was a remote code execution vulnerability that also involved the ObjectSerializationDecoder, caused by missing security checks during Java native deserialization. That earlier vulnerability led to the allowlist mechanism on the ObjectSerializationDecoder, built on its accept method.

A second bypass in the same area shows how hard Java object deserialization is to secure. Even with an allowlist in place, one unguarded branch in resolveClass() was enough for a complete bypass. It is a case for defense in depth. A single filtering checkpoint for deserialization safety remains fragile, particularly when the underlying resolution logic has multiple execution paths.

The Apache Software Foundation responded promptly. Venkatraman Kumar from Securin reported the vulnerability on April 17, 2026, and the advisory and patched releases were published on April 27, 2026.

References

• Apache MINA Advisory: CVE-2026-41635 (Apache Mailing List)
• CVE Record: CVE-2026-41635
• Apache MINA Project Homepage
• IoBuffer API Documentation (Apache MINA 2.0.26)
• ObjectSerializationDecoder API Documentation (Apache MINA 2.0.26)
• CVE-2024-52046 Detail (NVD)
• GitHub Advisory: Apache MINA Deserialization RCE Vulnerability (CVE-2024-52046)