Esta página ainda não foi traduzida para o seu idioma. Exibindo conteúdo em inglês enquanto trabalhamos nisso.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-41635: Insecure Deserialization in Apache MINA
Plataforma
java
Componente
apache-mina
Corrigido em
2.0.28
CVE-2026-41635 describes a critical insecure deserialization vulnerability discovered in Apache MINA. This flaw allows attackers to bypass security checks and potentially execute arbitrary code on vulnerable systems. The vulnerability affects versions 2.0.0 through 2.2.5 of Apache MINA, impacting applications that utilize its IoBuffer functionality. A fix is available in versions 2.0.28, 2.1.11, and 2.2.6.
Detecte esta CVE no seu projeto
Envie seu arquivo pom.xml e descubra na hora se você está afetado.
Impacto e Cenários de Ataquetraduzindo…
The insecure deserialization flaw in Apache MINA allows an attacker to craft malicious serialized objects that, when processed by the AbstractIoBuffer.resolveClass() method, bypass the intended classname allowlist. This bypass enables the execution of arbitrary code, effectively granting the attacker control over the affected system. The potential impact is severe, ranging from complete system compromise to data exfiltration and denial of service. Given the nature of deserialization vulnerabilities, this flaw shares similarities with the Log4Shell vulnerability, where a crafted input can trigger remote code execution. The blast radius extends to any application leveraging Apache MINA for network communication, particularly those handling untrusted data.
Contexto de Exploraçãotraduzindo…
CVE-2026-41635 was published on April 27, 2026. While no active exploitation campaigns have been publicly reported as of this writing, the vulnerability's critical severity and the potential for remote code execution suggest a high likelihood of exploitation. The vulnerability is not currently listed on KEV, but its EPSS score is likely to be assessed as high due to the ease of exploitation and potential impact. Public proof-of-concept (POC) code is anticipated to emerge, increasing the risk of widespread exploitation.
Inteligência de Ameaças
Status do Exploit
EPSS
0.14% (percentil 33%)
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Nenhum — sem autenticação necessária para explorar.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Alto — falha completa ou esgotamento de recursos. Negação de serviço total.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
- EPSS atualizado
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-41635 is to upgrade Apache MINA to a patched version: 2.0.28, 2.1.11, or 2.2.6. Before upgrading, assess the potential impact on existing application functionality, as changes in MINA versions could introduce compatibility issues. If a direct upgrade is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter potentially malicious serialized data. Specifically, configure the WAF to block requests containing suspicious deserialization patterns. Additionally, review and restrict the classes allowed for deserialization within your application's configuration. After upgrading, confirm the fix by attempting to trigger the deserialization process with a known malicious payload and verifying that it is blocked or handled safely.
Como corrigirtraduzindo…
Actualice Apache MINA a la versión 2.0.28 o superior, 2.1.11 o superior, o 2.2.6 o superior. Estas versiones aplican una validación más estricta de los nombres de clase durante la deserialización de objetos, previniendo la ejecución de código arbitrario.
Perguntas frequentestraduzindo…
What is CVE-2026-41635 — Insecure Deserialization in Apache MINA?
CVE-2026-41635 is a critical vulnerability in Apache MINA versions 2.0.0–2.2.5 allowing attackers to bypass classname allowlists and execute arbitrary code via insecure deserialization. This flaw impacts applications using MINA's IoBuffer functionality.
Am I affected by CVE-2026-41635 in Apache MINA?
If you are using Apache MINA versions 2.0.0 through 2.2.5, you are potentially affected. Verify your version and upgrade to 2.0.28, 2.1.11, or 2.2.6 to mitigate the risk.
How do I fix CVE-2026-41635 in Apache MINA?
Upgrade Apache MINA to version 2.0.28, 2.1.11, or 2.2.6. Consider implementing WAF rules to filter malicious serialized data as an interim measure while planning the upgrade.
Is CVE-2026-41635 being actively exploited?
While no active exploitation campaigns have been publicly reported, the vulnerability's critical severity and potential for remote code execution suggest a high likelihood of exploitation in the future.
Where can I find the official Apache MINA advisory for CVE-2026-41635?
Refer to the Apache MINA project website and security mailing lists for the official advisory and updates regarding CVE-2026-41635: https://mina.apache.org/
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Detecte esta CVE no seu projeto
Envie seu arquivo pom.xml e descubra na hora se você está afetado.
Escaneie seu projeto Java / Maven agora — sem conta
Envie seu pom.xml e receba o relatório de vulnerabilidades instantaneamente. Sem conta. Enviar o arquivo é só o começo: com uma conta você obtém monitoramento contínuo, alertas por Slack/e-mail, relatórios multi-projeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...