Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy
Assessment: Fully addressed.
When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list .
ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes
Assessment: Fully addressed.
For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes <clinit> of SomeClass — and many real-world classes have side-effecting static initialisers
Both issues have been fixed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.mina:mina-core | >= 2.2.0, < 2.2.8, >= 2.1.0, < 2.1.13, < 2.0.29 | 2.2.8, 2.1.13, 2.0.29 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-502- Platform
- Java / Kotlin (Maven)
- Package
org.apache.mina:mina-core- Disclosed
- 03.06.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v3pr-hxpr-mfm8 - CC BY 4.0
Vulnerability history: org.apache.mina:mina-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 11.2021 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 6
- High 1
- Medium 1
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 5
-
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.