CVE-2026-94301CWE-502insecure-deserialization

CVE-2026-94301

Critical · published September 21, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the

2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-21T19:17Z
References (2)
https://lists.apache.org/thread/rzos6zds5x7obl8trkvznt1djw4f996p · [email protected]https://lists.apache.org/thread/x4667tn5ozbvkc3wz87lhzogbfl0dczj · [email protected]
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 14:35Z
    Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
    cvelistv5