Most recent entries from all

bdu:2026-06348

certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1165

CLEANSTART-2026-BL56844 — fix for CVE-2026-41635 was not applied to the 2

Affected: CleanStart: apache-nifi

Security vulnerability affects the apache-nifi package. The fix for CVE-2026-41635 was not applied to the 2.

cnvd-2026-20429

EUVD-2026-308276

fkie_cve-2026-42779

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.

The fix checks if the class is present in the accepted class filter before calling Class.forName().

Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.

The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade.

GHSA-vf5j-865m-mq7c — Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

Affected: Maven: org.apache.mina:mina-core

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:

The fix checks if the class is present in the accepted class filter before calling Class.forName().

Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.

The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade.

NCSC-2026-0256 — Kwetsbaarheden verholpen in Oracle Communications

NCSC-2026-0256

OESA-2026-2241 — apache-mina security update

Affected: openEuler:20.03-LTS-SP4: apache-mina

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fix(es):

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.

Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.

The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier.

Affected are applications using Apache MINA that call IoBuffer.getObject().

Applications using Apache MINA are advised to upgrade(CVE-2026-41409)

The fix checks if the class is present in the accepted class filter before calling Class.forName().

Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and

2.2.0 <= 2.2.5.

The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier.

Affected are applications using Apache M…

RHSA-2026:60239 — Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…

UBUNTU-CVE-2026-42779

Affected: Ubuntu:Pro:22.04:LTS: mina2, Ubuntu:Pro:24.04:LTS: mina2, Ubuntu:25.10: mina2, Ubuntu:Pro:26.04:LTS: mina2

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.

WID-SEC-W-2026-2260 — IBM Operational Decision Manager: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.