What this actually is.
Technical background, root cause, and affected surface.
MINA's CompressionFilter inflates incoming zlib data without bounding the decompressed size, allocating a buffer for whatever the stream expands to. Data with very high compression ratios exhausts application memory. The fix adds an optional maxDecompressedSize limit plus maxDecompressRatio / decompressRatioMinSize controls.
- Product
- Apache MINA
- Vendor
- Apache
- Severity
- High
- CVSS Score
- 7.5
- Status
- Published
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CWE
- CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-789: Memory Allocation with Excessive Size Value
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
mina-filter-compression: CompressionFilter -> Zlib.inflate() allocates output buffer without size or ratio limit
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Memory exhaustion and denial of service of the MINA-based service
C:N · I:N · A:H
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-789: Memory Allocation with Excessive Size Value
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade Apache MINA to 2.2.8, 2.1.13 or 2.0.29 or later AND construct CompressionFilter with the new maxDecompressedSize parameter (optionally maxDecompressRatio and decompressRatioMinSize); the limit is not applied unless configured.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor
Fixed release published (2.2.8 / 2.1.13 / 2.0.29)
Vendor advisory published
CVE published to MITRE
Disclosed 12 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.