« Volver al listado

CVE-2026-41409

Estado: AnalizadaCrítica (9.8)—

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.

Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.

The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Deserialización insegura (CWE-502) en servicio de red sin autenticación (AV:N/PR:N). Ejecutable por atacante remoto no autenticado, permitiendo RCE vía gadget chain en inicializadores estáticos de clases.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Apache — Mina

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41409",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41409",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-27T12:21:46.348024Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache MINA",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.2.5"
            },
            {
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.1.10"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.0.27"
            }
          ],
          "packageName": "org.apache.mina:mina.core",
          "collectionURL": "https://repo.maven.apache.org/maven2/org/apache/mina/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-27T10:16:09.740",
  "references": [
    {
      "url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade"
    }
  ],
  "lastModified": "2026-06-17T10:46:40.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD2A5F4E-7B53-4235-BE01-DD9B9E3614E0",
              "versionEndExcluding": "2.0.28",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E69C9219-F00B-4677-88B8-3263615586BD",
              "versionEndExcluding": "2.1.11",
              "versionStartIncluding": "2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC86281C-5EBB-4250-8575-50EB77E76F3E",
              "versionEndExcluding": "2.2.6",
              "versionStartIncluding": "2.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}