此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-41635: Insecure Deserialization in Apache MINA
翻译中…平台
java
组件
apache-mina
修复版本
2.0.28
CVE-2026-41635 describes a critical insecure deserialization vulnerability discovered in Apache MINA. This flaw allows attackers to bypass security checks and potentially execute arbitrary code on vulnerable systems. The vulnerability affects versions 2.0.0 through 2.2.5 of Apache MINA, impacting applications that utilize its IoBuffer functionality. A fix is available in versions 2.0.28, 2.1.11, and 2.2.6.
检测此 CVE 是否影响你的项目
上传你的 pom.xml 文件，立即知道是否受影响。
影响与攻击场景翻译中…
The insecure deserialization flaw in Apache MINA allows an attacker to craft malicious serialized objects that, when processed by the AbstractIoBuffer.resolveClass() method, bypass the intended classname allowlist. This bypass enables the execution of arbitrary code, effectively granting the attacker control over the affected system. The potential impact is severe, ranging from complete system compromise to data exfiltration and denial of service. Given the nature of deserialization vulnerabilities, this flaw shares similarities with the Log4Shell vulnerability, where a crafted input can trigger remote code execution. The blast radius extends to any application leveraging Apache MINA for network communication, particularly those handling untrusted data.
利用背景翻译中…
CVE-2026-41635 was published on April 27, 2026. While no active exploitation campaigns have been publicly reported as of this writing, the vulnerability's critical severity and the potential for remote code execution suggest a high likelihood of exploitation. The vulnerability is not currently listed on KEV, but its EPSS score is likely to be assessed as high due to the ease of exploitation and potential impact. Public proof-of-concept (POC) code is anticipated to emerge, increasing the risk of widespread exploitation.
威胁情报
漏洞利用状态
EPSS
0.14% (33% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 高 — 完全崩溃或资源耗尽，完全拒绝服务。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2026-41635 is to upgrade Apache MINA to a patched version: 2.0.28, 2.1.11, or 2.2.6. Before upgrading, assess the potential impact on existing application functionality, as changes in MINA versions could introduce compatibility issues. If a direct upgrade is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter potentially malicious serialized data. Specifically, configure the WAF to block requests containing suspicious deserialization patterns. Additionally, review and restrict the classes allowed for deserialization within your application's configuration. After upgrading, confirm the fix by attempting to trigger the deserialization process with a known malicious payload and verifying that it is blocked or handled safely.
修复方法翻译中…
Actualice Apache MINA a la versión 2.0.28 o superior, 2.1.11 o superior, o 2.2.6 o superior. Estas versiones aplican una validación más estricta de los nombres de clase durante la deserialización de objetos, previniendo la ejecución de código arbitrario.
常见问题翻译中…
What is CVE-2026-41635 — Insecure Deserialization in Apache MINA?
CVE-2026-41635 is a critical vulnerability in Apache MINA versions 2.0.0–2.2.5 allowing attackers to bypass classname allowlists and execute arbitrary code via insecure deserialization. This flaw impacts applications using MINA's IoBuffer functionality.
Am I affected by CVE-2026-41635 in Apache MINA?
If you are using Apache MINA versions 2.0.0 through 2.2.5, you are potentially affected. Verify your version and upgrade to 2.0.28, 2.1.11, or 2.2.6 to mitigate the risk.
How do I fix CVE-2026-41635 in Apache MINA?
Upgrade Apache MINA to version 2.0.28, 2.1.11, or 2.2.6. Consider implementing WAF rules to filter malicious serialized data as an interim measure while planning the upgrade.
Is CVE-2026-41635 being actively exploited?
While no active exploitation campaigns have been publicly reported, the vulnerability's critical severity and potential for remote code execution suggest a high likelihood of exploitation in the future.
Where can I find the official Apache MINA advisory for CVE-2026-41635?
Refer to the Apache MINA project website and security mailing lists for the official advisory and updates regarding CVE-2026-41635: https://mina.apache.org/
检测此 CVE 是否影响你的项目
上传你的 pom.xml 文件，立即知道是否受影响。
立即扫描您的Java / Maven项目 — 无需账户
Upload your pom.xml and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...