CVE-2026-41635
Last modified
CVE-2026-41635 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.. EPSS estimates a 0.64% chance of exploitation in the next 30 days.
Description
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Mina | >= 2.0.0, < 2.0.28 |
| Apache | Mina | >= 2.1.0, < 2.1.11 |
| Apache | Mina | >= 2.2.0, < 2.2.6 |
References
- https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tmMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/27/4Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-41635?
How severe is CVE-2026-41635?
How do I fix CVE-2026-41635?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41612Relative path traversal in Visual Studio Code allows an unau…5.5
- CVE-2026-41613Session fixation in Visual Studio Code allows an unauthorize…8.8
- CVE-2026-41614Improper access control in M365 Copilot for Desktop allows a…6.2
- CVE-2026-41615Exposure of sensitive information to an unauthorized actor i…7.4
- CVE-2026-4162The Gravity SMTP plugin for WordPress is vulnerable to Missi…7.1
- CVE-2026-4163A vulnerability was detected in Wavlink WL-WN579A3 220323. T…9.8
- CVE-2026-41636Uncontrolled Recursion vulnerability in Apache Thrift Node.j…7.5
- CVE-2026-41637In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, cli…3.7
- CVE-2026-4164A flaw has been found in Wavlink WL-WN578W2 221110. Impacted…9.8
- CVE-2026-41640NocoBase is an AI-powered no-code/low-code platform for buil…8.8
- CVE-2026-41641NocoBase is an AI-powered no-code/low-code platform for buil…7.2
- CVE-2026-41642GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
Are you affected by CVE-2026-41635?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST