{"schemaVersion":3,"id":"CVE-2026-42779","aliases":["UBUNTU-CVE-2026-42779","CGA-3g7h-fxf6-ccqh","CGA-4x9w-qrcv-mch2","CGA-g6hp-5jqr-4h58","CGA-hvgp-rwwp-7qwc","CGA-r9w9-6fvh-8wr2","CGA-wqvh-m8vf-9g6v","CGA-2738-mf3c-pj48","CGA-2wg4-76h9-4ghf","CGA-33c5-9xh8-7f5p","CGA-3q67-mgw9-q462","CGA-4pm3-9v2m-wc68","CGA-5xfr-xw69-p278","CGA-644p-3432-7qxh","CGA-7fqj-289h-fjp3","CGA-7x9w-9gqh-jgh7","CGA-866j-3xv4-24hv","CGA-86m4-ppq2-gw36","CGA-g9v9-xmvc-p76p","CGA-hm76-v3gp-w3rc","CGA-hqrp-m66x-v996","CGA-jxw7-c45m-6hp9","CGA-m79q-gq6h-ww43","CGA-mc8j-c2x7-q97h","CGA-mf2c-vf2p-p3cc","GHSA-vf5j-865m-mq7c","CGA-qqj3-5r3g-6vwj","CGA-qrgm-fvjg-mv28","CGA-rrp3-2288-pm39","CGA-vcxc-gpfg-c4g6","CGA-whxm-826f-852v","CGA-xg7p-f5v4-pvr6"],"status":"published","duplicateOf":null,"title":null,"description":"The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:\n\n\n\n\n\n\n\n\n\n\n\nApache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.\n\n\n\n\nThe fix checks if the class is present in the accepted class filter before calling Class.forName().\n\n\n\n\n\n\nAffected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.\n\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by\napplying the classname allowlist earlier.\n\n\n\n\n\nAffected are applications using Apache MINA that call  IoBuffer.getObject().\n\n\n\n\n\nApplications using Apache MINA are advised to upgrade.","dates":{"published":"2026-05-01T10:00:43.712Z","modified":"2026-05-02T03:55:25.715Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00763,"percentile":0.54625,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.13900000000000007,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00902},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00763,"percentile":0.54625}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00902,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00763,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00763,"percentile":0.54625}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/502.html"}],"affected":[{"vendor":"apache software foundation","product":"apache mina","name":"Apache MINA","label":"apache mina","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.2.X, ≤ 2.2.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.1.X, ≤ 2.1.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.2.X, ≤ 2.2.6 | ≥ 2.1.X, ≤ 2.1.11","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_mina"},{"vendor":"apache","product":"mina","name":"mina","label":"mina","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.0, < 2.1.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.2.0, < 2.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 2.1.12 | ≥ 2.2.0, < 2.2.7","eol":null,"hubHref":"/vendor/apache/mina"},{"vendor":"chainguard","product":"apache-hop","name":"apache-hop","label":"apache-hop","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-hop","purlType":"apk","versions":[{"text":"< 2.17.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.17.0-r10","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"apache-hop","label":"Apache Hop","category":"app"}},"hubHref":null},{"vendor":"chainguard","product":"apache-hop-fips","name":"apache-hop-fips","label":"apache-hop-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-hop-fips","purlType":"apk","versions":[{"text":"< 2.17.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.17.0-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.9.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"guacamole-client-extensions","name":"guacamole-client-extensions","label":"guacamole-client-extensions","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/guacamole-client-extensions","purlType":"apk","versions":[{"text":"< 1.6.0-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.564-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.564-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.564-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.564-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-17","name":"jenkins-2.528-openjdk-17","label":"jenkins-2.528-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-17","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-21","name":"jenkins-2.528-openjdk-21","label":"jenkins-2.528-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541","name":"jenkins-2.541","label":"jenkins-2.541","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541","purlType":"apk","versions":[{"text":"< 2.541.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-17","name":"jenkins-2.541-openjdk-17","label":"jenkins-2.541-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-17","purlType":"apk","versions":[{"text":"< 2.541.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-21","name":"jenkins-2.541-openjdk-21","label":"jenkins-2.541-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-21","purlType":"apk","versions":[{"text":"< 2.541.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-25","name":"jenkins-2.541-openjdk-25","label":"jenkins-2.541-openjdk-25","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-25","purlType":"apk","versions":[{"text":"< 2.541.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.555","name":"jenkins-2.555","label":"jenkins-2.555","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.555","purlType":"apk","versions":[{"text":"< 2.555.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.555-openjdk-21","name":"jenkins-2.555-openjdk-21","label":"jenkins-2.555-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.555-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.555-openjdk-25","name":"jenkins-2.555-openjdk-25","label":"jenkins-2.555-openjdk-25","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.555-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.9.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.564-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.564-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.564-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.564-r1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mina2","name":"mina2","label":"mina2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mina2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.apache.mina","product":"mina-core","name":"org.apache.mina:mina-core","label":"mina-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.mina/mina-core","purlType":"maven","versions":[{"text":"≥ 2.1.0, < 2.1.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.2.0, < 2.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 2.1.12 | ≥ 2.2.0, < 2.2.7","eol":null,"hubHref":null}],"affectedCount":22,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0","label":"lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT","Advisory","WEB","Mailing List","Patch"]},{"url":"https://ubuntu.com/security/CVE-2026-42779","label":"ubuntu.com/security/CVE-2026-42779","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42779","label":"www.cve.org/CVERecord?id=CVE-2026-42779","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://repo.maven.apache.org/maven2","label":"repo.maven.apache.org/maven2","hostname":"repo.maven.apache.org","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42779.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42779.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42779","label":"nvd.nist.gov/vuln/detail/CVE-2026-42779","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/advisories/GHSA-8297-v2rf-2p32","label":"github.com/advisories/GHSA-8297-v2rf-2p32","hostname":"github.com","tags":["Advisory"]},{"url":"https://github.com/apache/mina","label":"github.com/apache/mina","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["USN-8465-1"],"duplicates":[],"related":["CGA-Q5JW-VWMH-F432"]},"timeline":[{"kind":"published","date":"2026-05-01T10:00:43.712Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-02T03:55:25.715Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:43:55.482Z","stale":false,"partial":false}}