What this actually is.
Technical background, root cause, and affected surface.
Apache MINA's AbstractIoBuffer.resolveClass() contains a code branch for static classes or primitive types that does not check against the acceptMatchers class filter, bypassing deserialization protection and enabling unauthenticated arbitrary code execution.
- Vendor
- Apache
- Product
- Apache Mina
- Severity
- Critical
- CVSS Score
- 9.8
- Status
- Published
- CWE
- CWE-502: Deserialization of Untrusted Data
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
AbstractIoBuffer.java: resolveClass() - if (clazz == null) { return Class.forName(desc.getName()); } // No acceptMatchers check; filter only applied in non-null clazz branch
Root cause: Incomplete filter coverage in resolveClass(): null-clazz branch does not invoke acceptMatchers check, allowing filter bypass for static class and primitive type descriptors
When does this fire?
All conditions must be true for the exploit to succeed.
Unauthenticated attacker sends a crafted serialized payload to a MINA network endpoint containing a class descriptor for a static class or primitive type, causing resolveClass() to take the unfiltered null-clazz branch and deserialize an arbitrary gadget chain class
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Arbitrary code execution on the MINA-based application host; complete bypass of all deserialization class filtering; full system compromise
C:H · I:H · A:H
CWE-502: Deserialization of Untrusted Data
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Apache MINA 2.0.28, 2.1.11, or 2.2.6. The fix adds the acceptMatchers filter check to the null-clazz branch in resolveClass() before calling Class.forName().
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
CVE published
Fix released in MINA 2.0.28, 2.1.11, 2.2.6
Disclosed 0 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.