https://seclists.org/oss-sec/2026/q3/848: CVE-2026-94301: Apache MINA: CVE-2026-47065 solveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDS-232

Q: Which Apache MINA releases should be considered affected?

Apache MINA 2.0.0 through 2.0.30 are affected, as are 2.1.0 through 2.1.14. This includes versions 2.0.29 and 2.1.13 that were previously listed as fixed for the related issue.

Q: Is upgrading to MINA 2.0.30 or 2.1.14 sufficient to address this issue?

No. The resolveProxyClass() override was not added to the 2.0.X or 2.1.X maintenance branches, so 2.0.30 and 2.1.14 remain vulnerable to the same allow-list bypass.

Q: What condition allows exploitation?

The issue is an acceptMatchers filter allow-list bypass involving java.lang.reflect.Proxy, caused by resolveProxyClass not being overridden. The supplied information does not specify additional authentication, access, or deployment prerequisites.

Q: How can I determine whether my deployment is still vulnerable?

Check the Apache MINA version in use. Deployments running a 2.0.X version before 2.0.31 or a 2.1.X version before 2.1.15 should be treated as affected.

Published Sep 21, 2026

Updated

Affected Software

2 affected components

Apache MINA<2.0.31

Apache MINA<2.1.15

Frequently Asked Questions

Which Apache MINA releases should be considered affected?

Apache MINA 2.0.0 through 2.0.30 are affected, as are 2.1.0 through 2.1.14. This includes versions 2.0.29 and 2.1.13 that were previously listed as fixed for the related issue.

Is upgrading to MINA 2.0.30 or 2.1.14 sufficient to address this issue?

No. The resolveProxyClass() override was not added to the 2.0.X or 2.1.X maintenance branches, so 2.0.30 and 2.1.14 remain vulnerable to the same allow-list bypass.

What condition allows exploitation?

The issue is an acceptMatchers filter allow-list bypass involving java.lang.reflect.Proxy, caused by resolveProxyClass not being overridden. The supplied information does not specify additional authentication, access, or deployment prerequisites.

How can I determine whether my deployment is still vulnerable?

Check the Apache MINA version in use. Deployments running a 2.0.X version before 2.0.31 or a 2.1.X version before 2.1.15 should be treated as affected.