rootpwn

critical · CVSS v3 9.8

CVE-2026-94301

CVE-2026-94301 exposes a proxy class resolution bypass in Apache MINA, allowing attackers to evade allow‑list checks and potentially execute

Overview

CVE-2026-94301 exposes a proxy class resolution bypass in Apache MINA, allowing attackers to evade allow‑list checks and potentially execute arbitrary code. The flaw remains in the 2.0.x and 2.1.x maintenance branches even though it was fixed in 2.2.x. It can compromise confidentiality, integrity, and availability of Java applications that use these libraries.

Description

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

Impact

Confidentiality: attackers can bypass access controls and read or modify protected data. Integrity: malicious code can alter application behavior or inject payloads. Availability: exploitation may lead to denial of service if the proxy mechanism is abused. Defenders: developers and system administrators using Apache MINA 2.0.x/2.1.x in Java applications are directly impacted.

Remediation

Upgrade to Apache MINA 2.2.8 or later, which includes the resolveProxyClass override. If an upgrade is not feasible, apply the patch from the 2.2.x branch to the 2.0.x/2.1.x codebase or disable Proxy-based allow‑list functionality. Verify the library version after patching and monitor for any related alerts.

Risk context

Severity is critical with a CVSS v3 score of 9.8. No EPSS data is available, but the vulnerability is actively exploitable and requires immediate attention.

Affected products

  • Apache MINA 2.0.x
  • Apache MINA 2.1.x

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
—
EPSS
—

proxy-bypass allow-list Apache MINA critical Java code-execution maintenance-branch

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-94142

CVE-2026-94142 exposes a write-what-where flaw in the BioStar Temperature Monitor Utility driver (BS_HWMIO64_W10.sys). The vulnerability allows a local attacker to manipulate the PhysicalAddress argument of the IOCTL handler, potentially leading to arbitrary memory writes. It is rated critical and has been publicly disclosed.

View analysis

critical

CVE-2026-94146

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94379

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47

View analysis