# org.apache.mina:mina-core (Maven) vulnerabilities 9 known vulnerabilities (7 critical), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.2.10 (Oct 14, 2026): no advisory affects it - Newest unaffected release: 2.2.10 (Oct 14, 2026), the latest release - Dependents: 9 - Releases: 87 since 1.0.0 (Oct 2, 2006) - Registry: https://central.sonatype.com/artifact/org.apache.mina/mina-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118636: no published release is affected - CVE-2026-47065: 1.0.0 to 2.0.28 (2.0.29 is outside it); 2.1.0 to 2.1.12 (2.1.13 is outside it); 2.2.0 to 2.2.7 (2.2.8 is outside it) - CVE-2026-42778: 2.1.0 to 2.1.11 (2.1.12 is outside it); 2.2.0 to 2.2.6 (2.2.7 is outside it) - CVE-2026-42779: 2.1.0 to 2.1.11 (2.1.12 is outside it); 2.2.0 to 2.2.6 (2.2.7 is outside it) - CVE-2026-41409: 2.0.0 to 2.0.27 (2.0.28 is outside it); 2.1.0 to 2.1.10 (2.1.11 is outside it); 2.2.0 to 2.2.5 (2.2.6 is outside it) - CVE-2026-41635: 2.0.0 to 2.0.27 (2.0.28 is outside it); 2.1.0 to 2.1.10 (2.1.11 is outside it); 2.2.0 to 2.2.5 (2.2.6 is outside it) - CVE-2024-52046: 2.0.0-M1 to 2.0.26 (2.0.27 is outside it); 2.1.0 to 2.1.9 (2.1.10 is outside it); 2.2.0 to 2.2.3 (2.2.4 is outside it) - CVE-2021-41973: 1.0.0 to 2.0.21 (2.0.22 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it) - CVE-2019-0231: 1.0.0 to 2.0.20 (2.0.21 is outside it); 2.1.0 (2.1.1 is outside it) ## Advisories (9) ### [CVE-2026-118636](https://cve.now/CVE-2026-118636): Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder - Severity: Critical 9.8 - Published: Oct 31, 2026 - Affected: from 3.0.0, through 3.0.0-M2. - No fix released. ### [CVE-2026-47065](https://cve.now/CVE-2026-47065): Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 - Severity: Critical 9.8 - Published: Jun 3, 2026 - Affected: from 2.2.0, fixed in 2.2.8; from 2.1.0, fixed in 2.1.13; from 2.0.0, fixed in 2.0.29; from 2.2.0, fixed in 2.2.8; from 2.1.0, fixed in 2.1.13; fixed in 2.0.29. - Fixed in 2.0.29 (released May 29, 2026, 5 days before disclosure), 2.1.13 (released May 29, 2026, 5 days before disclosure) and 2.2.8 (released May 29, 2026, 5 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2026-42778](https://cve.now/CVE-2026-42778): Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) - Severity: Critical 9.8 - Published: May 1, 2026 - Affected: from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.7. - Fixed in 2.1.12 (released Apr 29, 2026, 2 days before disclosure) and 2.2.7 (released Apr 29, 2026, 2 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2026-42779](https://cve.now/CVE-2026-42779): Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2) - Severity: Critical 9.8 - Published: May 1, 2026 - Affected: from 2.2.X, through 2.2.6; from 2.1.X, through 2.1.11; from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.7. - Fixed in 2.1.12 (released Apr 29, 2026, 2 days before disclosure) and 2.2.7 (released Apr 29, 2026, 2 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2026-41409](https://cve.now/CVE-2026-41409): Apache MINA: CWE-502 Deserialization of Untrusted Data - Severity: Critical 9.8 - Published: Apr 27, 2026 - Affected: from 2.0.0, fixed in 2.0.28; from 2.1.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6. - Fixed in 2.0.28 (released Apr 24, 2026, 3 days before disclosure), 2.1.11 (released Apr 24, 2026, 3 days before disclosure) and 2.2.6 (released Apr 24, 2026, 3 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2026-41635](https://cve.now/CVE-2026-41635): Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE - Severity: Critical 9.8 - Published: Apr 27, 2026 - Affected: from 2.2.0, through 2.2.5; from 2.1.0, through 2.1.10; from 2.0.0, through 2.0.27; from 2.0.0, fixed in 2.0.28; from 2.1.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6. - Fixed in 2.0.28 (released Apr 24, 2026, 3 days before disclosure), 2.1.11 (released Apr 24, 2026, 3 days before disclosure) and 2.2.6 (released Apr 24, 2026, 3 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2024-52046](https://cve.now/CVE-2024-52046): Apache MINA: MINA applications using unbounded deserialization may allow RCE - Severity: Critical 10.0 - Published: Dec 25, 2024 - Affected: from 2.1, through 2.1.9; from 2.2, through 2.2.3; from 2.2.0, fixed in 2.2.4; from 2.1.0, fixed in 2.1.10; from 2.0.0-M1, fixed in 2.0.27. - Fixed in 2.0.27 (released Dec 19, 2024, 6 days before disclosure), 2.1.10 (released Dec 19, 2024, 6 days before disclosure) and 2.2.4 (released Dec 19, 2024, 6 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2021-41973](https://cve.now/CVE-2021-41973): Apache MINA HTTP listener DOS - Severity: Unrated - Published: Nov 1, 2021 - Affected: from 2.1.0, fixed in 2.1.5; fixed in 2.0.22. - Fixed in 2.0.22 (released Oct 17, 2021, 15 days before disclosure) and 2.1.5 (released Oct 4, 2021, 28 days before disclosure). - The latest release, 2.2.10, is not affected. ### [CVE-2019-0231](https://cve.now/CVE-2019-0231): Apache MINA SSLFilter security Issue - Severity: Unrated - Published: Oct 1, 2019 - Affected: fixed in 2.0.21; from 2.1.0, fixed in 2.1.1. - Fixed in 2.0.21 (released Apr 12, 2019, 172 days before disclosure) and 2.1.1 (released Apr 12, 2019, 172 days before disclosure). - The latest release, 2.2.10, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.mina:mina-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.