Deserialization allow-list bypass in Apache Software Foundation Apache MINA

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

• Apache MINA 2.0.x branch: affected from 2.0.0 through versions less than 2.0.31. This includes 2.0.29 and 2.0.30, which the supplied description says remain vulnerable.
• Apache MINA 2.1.x branch: affected from 2.1.0 through versions less than 2.1.15. This includes 2.1.13 and 2.1.14, which the supplied description says remain vulnerable.
• The description says the correction was committed only to 2.2.X and that MINA 2.2.8 was announced as fully addressed. The structured affected data does not provide a complete range for all of 2.2.X, so this entry does not infer the status of every release in that branch.

Apache Software Foundation Apache MINA has a branch-specific correction gap: the resolveProxyClass() override intended to enforce the acceptMatchers filter was committed only to one maintenance branch. The affected branches therefore continue to use an implementation in which proxy-class resolution can bypass the intended allow-list. The weakness is classified as CWE-502, so the relevant trust boundary is deserialization of attacker-controlled or otherwise untrusted data. The structured attack assessment describes network reachability without authentication or user interaction and low complexity, but the record does not identify the exposed endpoint, message type, serialization format, or exact object graph. Scope is unchanged, so any resulting effects remain within the vulnerable application's security authority.

• Reachability: The attack path is assessed as network reachable, with no authentication or user interaction required and low complexity.
• Mechanism: Exploitation depends on reaching the deserialization flow where the acceptMatchers allow-list is expected to constrain proxy classes. The exact endpoint and serialized input are not documented.
• Status: The supplied record does not identify a public exploit. CISA ADP enrichment returned during research assessed exploitation as none, but that is an assessment at the recorded time and does not prove exploitation is impossible or absent from every environment.

Successful exploitation could bypass the intended class allow-list during deserialization. Based on the supplied impact assessment, the likely technical outcomes include unauthorized disclosure, modification of application-controlled data or state, and service unavailability. The record states that the attack does not require prior privileges or user interaction, increasing exposure for network-reachable deployments. The exact impact still depends on the application using MINA, the objects it deserializes, and the permissions of the process; these details are not provided.

Apache Software Foundation Apache MINA deployments can accept data that the application intended to reject if the allow-list is bypassed. This can undermine a boundary meant to constrain deserialization and may lead to data exposure, data modification, or service disruption, depending on what the target application deserializes and what privileges the process has. The record does not establish a specific breach, victim, or downstream gadget chain. Actual impact therefore needs to be assessed together with the application using MINA, its input paths, and its runtime permissions.

1. Inventory direct and transitive Apache MINA dependencies, including shaded or bundled artifacts.
2. For 2.0.x deployments, move to 2.0.31. For 2.1.x deployments, move to 2.1.15. These are the first boundaries outside the affected ranges supplied for those branches. Do not treat 2.0.29, 2.0.30, 2.1.13, or 2.1.14 as remediated.
3. If using 2.2.x, verify that the vendor's branch-specific correction is actually present in the artifact being deployed. The record says the override was committed there but does not provide a complete matrix for the entire branch.
4. Until upgrade, restrict untrusted network access to affected services as a precaution. No vendor-confirmed workaround or configuration mitigation is provided in the supplied record.

1. Inventory Apache MINA dependencies in manifests, lockfiles, package metadata, and runtime classpaths, including transitive and shaded copies.
2. Compare each discovered release with the affected boundaries in affected_summary. Explicitly flag artifacts previously labeled as fixed on the older maintenance branches because the record says those artifacts can still be vulnerable.
3. If source or bytecode is available, verify that the relevant deserialization implementation contains the intended resolveProxyClass() override and that the acceptMatchers filter is applied to proxy-class resolution. Treat a missing override as a strong review signal, especially for shaded or repackaged builds, not as proof that every surrounding integration is exploitable.
4. Review network telemetry and application errors around deserialization or unexpected proxy-class resolution as a precaution. The record supplies no specific log event, IOC, payload signature, or endpoint, and absence of such evidence does not prove safety.