UBUNTU-CVE-2026-47321

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-47321
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-47321
Upstream
  • CVE-2026-47321
Published
2026-09-21T08:16:00Z
Modified
2026-09-24T02:00:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an exhaustion of the application memory, as we don't control the deflated size. The fix adds such a control by allowing the application developer to provide a fixed size limit, which when reached throws an exception. It also allows the user to provide a compression ratio that should not be exceeded, protected the application from small inflated files that inflate in gigantic files, but with a grace limit for the resulting size (1Mb) to avoid false positive (like a very small file inflating with a high ratio, but resulting with a acceptable size, like a few thousands bytes) For application using this feature, it is highly recommended to create the CompressionFilter and to pass the maximum limit as a forth constructor parameter, maxDecompressedSize: public CompressionFilter(final boolean compressInbound, final boolean compressOutbound, final int compressionLevel, final int maxDecompressedSize)Optionally one can also provide a maxDecompressRatio fifth parameter, and a decompressRatioMinSize sixth parameter to allow small inflated files with a high compression ratio to still be accepted. Here are the additional constructor: public CompressionFilter(final boolean compressInbound, final boolean compressOutbound, final int compressionLevel, final int maxDecompressedSize, final long maxDecompressRatio, final long decompressRatioMinSize) Also note that a fluent API has been added to spare the users the pain to call a constructor with that many parameters:  CompressionFilter compressionFilter = new CompressionFilter() .setCompressionLevel(Zlib.COMPRESSION_MAX) .setMaxDecompressedSize(1_000_000) .setMaxDecompressRatio(100). .setDecompressRatioMinSize(100_000); Applications using Apache MINA are advised to upgrade and configure their CompressionFilter instance.

References

Affected packages

Ubuntu:16.04:LTS
mina

Package

Name
mina
Purl
pkg:deb/ubuntu/mina?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.7.dfsg-11

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina-java",
            "binary_version":  "1.1.7.dfsg-11"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.7+dfsg-2
2.0.9-1
2.0.9-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.0.9-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:18.04:LTS
mina

Package

Name
mina
Purl
pkg:deb/ubuntu/mina?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.7.dfsg-11
1.1.7.dfsg-12

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina-java",
            "binary_version":  "1.1.7.dfsg-12"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.16-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.0.16-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:20.04:LTS
mina

Package

Name
mina
Purl
pkg:deb/ubuntu/mina?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.7.dfsg-13

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina-java",
            "binary_version":  "1.1.7.dfsg-13"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.19-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.0.19-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:22.04:LTS
mina

Package

Name
mina
Purl
pkg:deb/ubuntu/mina?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.7.dfsg-13

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina-java",
            "binary_version":  "1.1.7.dfsg-13"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:24.04:LTS
mina

Package

Name
mina
Purl
pkg:deb/ubuntu/mina?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.7.dfsg-13
1.1.7.dfsg-13ubuntu1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina-java",
            "binary_version":  "1.1.7.dfsg-13ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:25.10
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.1-3
2.2.1-4

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.2.1-4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:Pro:22.04:LTS
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.1.4-2
2.1.5-1
2.1.5-1ubuntu0.1~esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.1.5-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:Pro:24.04:LTS
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.1-3
2.2.1-3ubuntu0.1~esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.2.1-3ubuntu0.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"
Ubuntu:Pro:26.04:LTS
mina2

Package

Name
mina2
Purl
pkg:deb/ubuntu/mina2?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.1-4
2.2.1-4ubuntu0.1~esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libmina2-java",
            "binary_version":  "2.2.1-4ubuntu0.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47321.json"