Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.mina:mina-core

9 known vulnerabilities (7 critical), with the versions each affects and the releases that fix them.

Latest release
2.2.10 (Oct 14, 2026): no advisory affects it
Newest unaffected release
2.2.10 (Oct 14, 2026), the latest release
Advisories
9 · 7 critical
Dependents
9
Releases
87 since 1.0.0 (Oct 2, 2006)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-118636
    No published release is affected
    No published release is affected
  • CVE-2026-47065
    Affects 1.0.0 to 2.0.28 (2.0.29 is outside it); 2.1.0 to 2.1.12 (2.1.13 is outside it); 2.2.0 to 2.2.7 (2.2.8 is outside it)
  • CVE-2026-42778
    Affects 2.1.0 to 2.1.11 (2.1.12 is outside it); 2.2.0 to 2.2.6 (2.2.7 is outside it)
  • CVE-2026-42779
    Affects 2.1.0 to 2.1.11 (2.1.12 is outside it); 2.2.0 to 2.2.6 (2.2.7 is outside it)
  • CVE-2026-41409
    Affects 2.0.0 to 2.0.27 (2.0.28 is outside it); 2.1.0 to 2.1.10 (2.1.11 is outside it); 2.2.0 to 2.2.5 (2.2.6 is outside it)
  • CVE-2026-41635
    Affects 2.0.0 to 2.0.27 (2.0.28 is outside it); 2.1.0 to 2.1.10 (2.1.11 is outside it); 2.2.0 to 2.2.5 (2.2.6 is outside it)
  • CVE-2024-52046
    Affects 2.0.0-M1 to 2.0.26 (2.0.27 is outside it); 2.1.0 to 2.1.9 (2.1.10 is outside it); 2.2.0 to 2.2.3 (2.2.4 is outside it)
  • CVE-2021-41973
    Affects 1.0.0 to 2.0.21 (2.0.22 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it)
  • CVE-2019-0231
    Affects 1.0.0 to 2.0.20 (2.0.21 is outside it); 2.1.0 (2.1.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

  • CVE-2026-118636Critical 9.8

    Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

    Affected: from 3.0.0, through 3.0.0-M2.

    No fix released.

  • CVE-2026-47065Critical 9.8

    Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

    Affected: from 2.2.0, fixed in 2.2.8; from 2.1.0, fixed in 2.1.13; from 2.0.0, fixed in 2.0.29; from 2.2.0, fixed in 2.2.8; from 2.1.0, fixed in 2.1.13; fixed in 2.0.29.

    Fixed in 2.0.29 (released May 29, 2026, 5 days before disclosure), 2.1.13 (released May 29, 2026, 5 days before disclosure) and 2.2.8 (released May 29, 2026, 5 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • CVE-2026-42778Critical 9.8

    Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)

    Affected: from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.7.

    Fixed in 2.1.12 (released Apr 29, 2026, 2 days before disclosure) and 2.2.7 (released Apr 29, 2026, 2 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • CVE-2026-42779Critical 9.8

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

    Affected: from 2.2.X, through 2.2.6; from 2.1.X, through 2.1.11; from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.7.

    Fixed in 2.1.12 (released Apr 29, 2026, 2 days before disclosure) and 2.2.7 (released Apr 29, 2026, 2 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • CVE-2026-41409Critical 9.8

    Apache MINA: CWE-502 Deserialization of Untrusted Data

    Affected: from 2.0.0, fixed in 2.0.28; from 2.1.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6.

    Fixed in 2.0.28 (released Apr 24, 2026, 3 days before disclosure), 2.1.11 (released Apr 24, 2026, 3 days before disclosure) and 2.2.6 (released Apr 24, 2026, 3 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • CVE-2026-41635Critical 9.8

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE

    Affected: from 2.2.0, through 2.2.5; from 2.1.0, through 2.1.10; from 2.0.0, through 2.0.27; from 2.0.0, fixed in 2.0.28; from 2.1.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6.

    Fixed in 2.0.28 (released Apr 24, 2026, 3 days before disclosure), 2.1.11 (released Apr 24, 2026, 3 days before disclosure) and 2.2.6 (released Apr 24, 2026, 3 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • CVE-2024-52046Critical 10.0

    Apache MINA: MINA applications using unbounded deserialization may allow RCE

    Affected: from 2.1, through 2.1.9; from 2.2, through 2.2.3; from 2.2.0, fixed in 2.2.4; from 2.1.0, fixed in 2.1.10; from 2.0.0-M1, fixed in 2.0.27.

    Fixed in 2.0.27 (released Dec 19, 2024, 6 days before disclosure), 2.1.10 (released Dec 19, 2024, 6 days before disclosure) and 2.2.4 (released Dec 19, 2024, 6 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • Apache MINA HTTP listener DOS

    Affected: from 2.1.0, fixed in 2.1.5; fixed in 2.0.22.

    Fixed in 2.0.22 (released Oct 17, 2021, 15 days before disclosure) and 2.1.5 (released Oct 4, 2021, 28 days before disclosure).

    The latest release, 2.2.10, is not affected.

  • Apache MINA SSLFilter security Issue

    Affected: fixed in 2.0.21; from 2.1.0, fixed in 2.1.1.

    Fixed in 2.0.21 (released Apr 12, 2019, 172 days before disclosure) and 2.1.1 (released Apr 12, 2019, 172 days before disclosure).

    The latest release, 2.2.10, is not affected.