VDB
CVE-2026-41635
CVE-2026-41635
PUBLISHED
CVSS 9.800000190734863 CRITICAL
CVE-2026-41635 is an arbitrary code execution vulnerability in Apache MINA. The AbstractIoBuffer.resolveClass() method contains two branches, where one of them performs no class validation, bypassing the classname allowlist entirely. This results in arbitrary code execution. Systems affected are applications using Apache MINA that call the IoBuffer.getObject() method.
EPSS 0.82% · 56.3th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.82%
56.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5 |
Timeline
- Apr 27, 2026 CVE Published
- May 16, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score
- May 28, 2026 EPSS Score
- May 30, 2026 EPSS Score