PT-2026-36314 · Apache · Apache Mina

Published 2026-05-01 · Updated 2026-06-04 · CVE-2026-42778

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache MINA versions prior to 2.2.7 Apache MINA versions prior to 2.1.12

Description An issue exists in the Java network application framework due to flaws in the deserialization mechanism. The software deserializes data from unknown network sources without proper validation. When a client sends specially crafted serialized Java objects, the system reconstructs these objects, which can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information, potentially leading to remote code execution.

Recommendations Update to version 2.2.7. Update to version 2.1.12.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-06347

CLEANSTART-2026-DD05788

CLEANSTART-2026-LE11246

CLEANSTART-2026-LO22603

CLEANSTART-2026-RN56220

CVE-2026-42778

GHSA-995C-6RP3-4M4X

OESA-2026-2241

OESA-2026-2242

OESA-2026-2243

OESA-2026-2244

OESA-2026-2245

Affected Products

Apache Mina

References · 279

• https://nvd.nist.gov/vuln/detail/CVE-2023-2976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10237 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47535 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5115 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34453 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-52046 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42584 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DD05788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42778 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3509 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23015 · Security Note
• https://osv.dev/vulnerability/GHSA-995c-6rp3-4m4x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Security Note