Debian/mina2: critical 9.8
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing
Action: Upgrade mina2 to 2.2.9-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.2.9-1 | - |
Fixed versions
| 2.2.9-1 |
Sources
- osv: DEBIAN-CVE-2026-41635#Debian:14/mina2
- https://security-tracker.debian.org/tracker/CVE-2026-41635
published · modified · JSON