Detections
Analytics

SCA: security update for org.apache.mina:mina-core (GHSA-8297-v2rf-2p32)

critical Tenable Self-Hosted Container Security Plugin ID 441433

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or
 primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary
 code to be executed. The fix checks if the class is present in the accepted class filter before calling
 Class.forName(). Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.
 The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist
 earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using
 Apache MINA are advised to upgrade. (CVE-2026-41635)

Solution

Update the org.apache.mina:mina-core library and its related packages to version 2.0.28 or later.

See Also

https://github.com/advisories/GHSA-8297-v2rf-2p32

Plugin Details

Severity: Critical

ID: 441433

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/7/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.47

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-41635

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/27/2026

Vulnerability Publication Date: 4/27/2026

Reference Information

CVE: CVE-2026-41635

cwe: CWE-502