The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname
    allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class
    to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <=
    2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying
    the classname allowlist earlier. Affected are applications using Apache MINA that call
    IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade (CVE-2026-41409)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname     allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class     to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <=     2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying     the classname allowlist earlier. Affected are applications using Apache MINA that call     IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade (CVE-2026-41409)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
441263	SCA: security update for org.apache.mina:mina-core (GHSA-f2wh-grmh-r6jm)	Tenable Cloud Security	SCA Checks	critical
441263	SCA: security update for org.apache.mina:mina-core (GHSA-f2wh-grmh-r6jm)	Tenable Self-Hosted Container Security	SCA Checks	critical
310668	Linux Distros Unpatched Vulnerability : CVE-2026-41409	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-41409

critical

Tenable Plugins

critical

critical

critical