Mina
Vendor:
First CVE: Oct 1, 2019 · Active for 6 years
8
Total CVEs
More Total CVEs than 85% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
9.1
Avg CVSS
Higher Avg CVSS than 84% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Mina over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 1, 2019
6 years ago
Most Recent CVE
Jun 3, 2026
51 days ago
CVE Severity & Scoring
Mina8 CVEs
13%
13%
75%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (87.5%)
Unknown0 (0.0%)
Required1 (12.5%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None8 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-52046CRITICAL The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process
incoming serialized data but lacks the necessary security checks and defenses. | Dec 25, 2024 | 9.8 | 46 | NO | NO |
CVE-2026-42779CRITICAL The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:
Apache MINA's AbstractIoBuffer.resolveClass() contai | May 1, 2026 | 9.8 | 42 | NO | NO |
CVE-2026-47065CRITICAL ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy
Assessment: Fully addressed.
When the serialised stream contains a TC_PRO | Jun 3, 2026 | 9.8 | 40 | NO | NO |
CVE-2026-42778CRITICAL The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer. | May 1, 2026 | 9.8 | 40 | NO | NO |
CVE-2026-41409CRITICAL The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a st | Apr 27, 2026 | 9.8 | 40 | NO | NO |
CVE-2026-41635CRITICAL Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname al | Apr 27, 2026 | 9.8 | 40 | NO | NO |
CVE-2019-0231HIGH Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear | Oct 1, 2019 | 7.5 | 25 | NO | NO |
CVE-2021-41973MEDIUM In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginn | Nov 1, 2021 | 6.5 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Mina
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.2.8 | 1 | 9.8 | 0.5% | 0 | 0 |
| 2.1.13 | 1 | 9.8 | 0.5% | 0 | 0 |
| 2.1.1 | 1 | 7.5 | 2.2% | 0 | 0 |
| 2.0.29 | 1 | 9.8 | 0.5% | 0 | 0 |
| 2.0.20 | 1 | 7.5 | 2.2% | 0 | 0 |