CVE-2026-41409 - Vulnerability Analysis

Overview

Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5 contain an insecure deserialization caused by late application of classname allowlist in AbstractIoBuffer.getObject(), letting attackers execute malicious deserialization, exploit requires use of IoBuffer.getObject().

Severity & Score

Impact

Attackers can execute arbitrary code via crafted deserialization, potentially leading to full system compromise.

Mitigation

Upgrade to Apache MINA 2.0.28, 2.1.11, or 2.2.6 or later.

References

• https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

May 1, 2026

🔴 CVE-2026-42778 - Critical (9.8) The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allo... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42778/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner