Apache Software Foundation Apache MINA
10 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-94301 | 2.0.0 – < 2.0.31 ; 2.1.0 – < 2.1.15 | Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-47321 | 2.2.0 – < 2.2.8 ; 2.1.0 – < 2.1.13 ; 2.0.0 – < 2.0.29 | Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate | HIGH 7.5 | 0.5 % | ||
| CVE-2026-47065 | 2.2.0 – < 2.2.8 ; 2.1.0 – < 2.1.13 ; 2.0.0 – < 2.0.29 | Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-42778 | 2.2.X – 2.2.6 ; 2.1.X – 2.1.11 | Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-42779 | 2.2.X – 2.2.6 ; 2.1.X – 2.1.11 | Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2) | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-41409 | 2.2.0 – 2.2.5 ; 2.1.0 – 2.1.10 ; 2.0.0 – 2.0.27 | Apache MINA: CWE-502 Deserialization of Untrusted Data | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-41635 | 2.2.0 – 2.2.5 ; 2.1.0 – 2.1.10 ; 2.0.0 – 2.0.27 | Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-52046 | 2.1 – 2.1.9 ; 2.2 – 2.2.3 | Apache MINA: MINA applications using unbounded deserialization may allow RCE | CRITICAL 10.0 | 24 % | ||
| CVE-2021-41973 | Apache MINA – < 2.1.5 | Apache MINA HTTP listener DOS | MEDIUM 6.5 | 4.6 % | ||
| CVE-2019-0231 | Apache MINA 2.1 2.1.0 ; Apache MINA 2.0 2.0.21 | Apache MINA SSLFilter security Issue | HIGH 7.5 | 2.1 % |