Description

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the  2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-21T15:17:38.903Z",
  "pubdate": "2026-09-21T15:17:38.903Z",
  "executiveSummary": "The vulnerability CVE-2026-47065 involves a failure to override the resolveProxyClass() method in Java deserialization filters, leading to an allow-list bypass via java.lang.reflect.Proxy.\nAlthough marked as resolved in MINA 2.0.29 and 2.1.13, the fix was exclusively applied to the 2.2.X branch, leaving the 2.0.X and 2.1.X maintenance lines inherently vulnerable.\nThis vulnerability facilitates unauthorized object deserialization, potentially enabling remote code execution (RCE) by bypassing established security constraints within the serialization mechanism.\nThe flaw affects all versions of MINA 2.0.X up to 2.0.30 and 2.1.X up to 2.1.14.\nExploitation requires an attacker to provide a malicious serialized payload that leverages dynamic proxy objects to circumvent filtering mechanisms intended to restrict class instantiation.\nThe risk is critical due to the persistent nature of the bypass and the continued presence of the vulnerability in widely deployed legacy branches, despite official claims of remediation.",
  "technicalDetails": "The root cause of this vulnerability is the failure to properly override the resolveProxyClass() method within the custom ObjectInputStream implementation used for deserialization in the MINA library.\nIn Java serialization, the resolveProxyClass() method is responsible for resolving the proxy class for the interfaces specified in the stream. By default, it allows the creation of dynamic proxy instances. If this method is not overridden to apply the same validation logic used in resolveClass(), it provides an entry point for an attacker to bypass class allow-lists.\nThe attack flow leverages the fact that many security filters focus exclusively on validating class names via resolveClass() but neglect the proxy-specific resolution path. An attacker constructs a malicious payload containing a java.lang.reflect.Proxy object that implements interfaces considered benign by the filter. During deserialization, the Proxy object is instantiated through the un-overridden resolveProxyClass() method, effectively bypassing the security check.\nOnce the proxy is instantiated, the attacker can redirect method invocations to other classes present in the application's classpath, often referred to as 'gadget chains.' This allows for the execution of arbitrary code, data exfiltration, or denial-of-service attacks, depending on the available gadgets in the environment.\nThe vulnerability is persistent in MINA 2.0.X (up to 2.0.30) and 2.1.X (up to 2.1.14) because the patch committed to the 2.2.X branch was not backported. Consequently, even systems updated to the 'fixed' versions 2.0.29 or 2.1.13 remain exposed to the exact same vector that CVE-2026-47065 intended to address.\nExploitation is typically unauthenticated and network-accessible, as it occurs at the point where serialized data is processed by the MINA transport layer. The impact is significant as it allows attackers to bypass existing serialization hardening, rendering typical allow-list configurations ineffective against proxy-based injection vectors."
}