GHSA-v3pr-hxpr-mfm8

Suggest an improvement
Source
https://github.com/advisories/GHSA-v3pr-hxpr-mfm8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v3pr-hxpr-mfm8/GHSA-v3pr-hxpr-mfm8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v3pr-hxpr-mfm8
Aliases
Downstream
Published
2026-06-03T12:30:26Z
Modified
2026-09-10T03:51:09Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass
Details

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy

Assessment: Fully addressed.

When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list .

ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes

Assessment: Fully addressed.

For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes of SomeClass — and many real-world classes have side-effecting static initialisers

Both issues have been fixed.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-13T17:24:46Z",
    "nvd_published_at": "2026-06-03T11:16:19Z",
    "severity": "CRITICAL"
}
References

Affected packages

Maven / org.apache.mina:mina-core

Package

Name
org.apache.mina:mina-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mina/mina-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.8

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v3pr-hxpr-mfm8/GHSA-v3pr-hxpr-mfm8.json"

Maven / org.apache.mina:mina-core

Package

Name
org.apache.mina:mina-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mina/mina-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.13

Affected versions

2.*
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v3pr-hxpr-mfm8/GHSA-v3pr-hxpr-mfm8.json"

Maven / org.apache.mina:mina-core

Package

Name
org.apache.mina:mina-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mina/mina-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.29

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
2.*
2.0.0-M1
2.0.0-M2
2.0.0-M3
2.0.0-M4
2.0.0-M5
2.0.0-M6
2.0.0-RC1
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v3pr-hxpr-mfm8/GHSA-v3pr-hxpr-mfm8.json"