CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

Published Sep 21, 2026

Updated

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

Affected Software

1 affected component

Apache MINA>=2.0.29<2.0.30, =2.0.30, >=2.1.13<2.1.14, =2.1.14, >=2.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache MINA to a version that resolves this vulnerability.
Fixed in 2.2.8Patch CVE-2026-47065
Upgrade
Upgrade Apache MINA to a version that resolves this vulnerability.
Fixed in 2.1.13Patch ZDRES-232
Upgrade
Upgrade Apache MINA to a version that resolves this vulnerability.
Fixed in 2.0.29Patch ZDRES-232

Event History

Sep 21, 2026

CVE Published

via MITRE·02:35 PM

Data Sourced

via MITRE·02:35 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Apache MINA versions remain affected?

The 2.0.X and 2.1.X maintenance lines remain vulnerable, including versions described as fixed: 2.0.29, 2.1.13, and later releases through 2.0.30 and 2.1.14. The resolveProxyClass() override was committed only to the 2.2.X branch; MINA 2.2.8 is identified as fully addressed.

What does an attacker need to exploit this issue?

The supplied severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required. The flaw is an allow-list bypass involving java.lang.reflect.Proxy and acceptMatchers filtering.

How can I determine whether my deployment is affected?

Identify the Apache MINA artifact version in use. Deployments using the 2.0.X or 2.1.X lines, including the current 2.0.30 and 2.1.14 releases, should be treated as affected because those branches lack the required resolveProxyClass() override.