As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
Apache MINA versions 2.0.x before 2.0.31 and 2.1.x before 2.1.15 lack a critical security fix for CVE-2026-47065 that allows bypass of acceptMatchers filters through java.lang.reflect.Proxy manipulation. The vulnerability patch, initially released June 2, 2026, was applied only to the 2.2.X branch despite being marked as fully addressed across all versions. Users of the older maintenance branches remain exposed to proxy class resolution attacks.
Why it matters: Organizations running Apache MINA 2.0.x or 2.1.x in production need to upgrade immediately to 2.0.31 or 2.1.15 respectively to close the filter bypass vulnerability, or migrate to 2.2.8 or later.
- Source published
- First seen by Cybersecurity Tracker