PT-2024-9987 · Apache+1 · Apache Mina+1

Emmanuel Lécharny · Published 2024-12-24 · Updated 2026-05-18 · CVE-2024-52046

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.0.X through 2.2.X

Description The ObjectSerializationDecoder in Apache MINA lacks necessary security checks when processing incoming serialized data using Java’s native deserialization protocol. This allows attackers to send crafted malicious serialized data, potentially leading to remote code execution (RCE). The IoBuffer#getObject() method is a key component in the exploitation chain, particularly when used with the ObjectSerializationCodecFactory class.

Recommendations Upgrade to versions 2.0.27, 2.1.10, or 2.2.4. Additionally, explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance using one of the following methods: accept(ClassNameMatcher classNameMatcher), accept(Pattern pattern), or accept(String... patterns).

Fix

RCE

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

BDU:2025-00105

CLEANSTART-2026-DD05788

CLEANSTART-2026-SQ91016

CLEANSTART-2026-VH41554

CLEANSTART-2026-WK99982

CVE-2024-52046

GHSA-76H9-2VWH-W278

OESA-2025-1044

Affected Products

Apache Mina

Debian

References · 366

• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-12801 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34455 · Security Note
• https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27821 · Security Note
• https://osv.dev/vulnerability/GHSA-76h9-2vwh-w278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note