CVE-2026-41409

Name	CVE-2026-41409
Description	The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1135347

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mina (PTS)	bookworm, bullseye	1.1.7.dfsg-13	fixed
mina2 (PTS)	bullseye	2.1.4-2	fixed
	bookworm	2.2.1-3	fixed
	forky, sid, trixie	2.2.1-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
mina	source	(unstable)	(not affected)
mina2	source	bullseye	(not affected)
mina2	source	bookworm	(not affected)
mina2	source	(unstable)	(unfixed)	1135347

Notes

[trixie] - mina2 <no-dsa> (Minor issue)
[bookworm] - mina2 <not-affected> (Incomplete fix for CVE-2024-52046 not applied)
[bullseye] - mina2 <not-affected> (Incomplete fix for CVE-2024-52046 not applied)
- mina <not-affected> (Incomplete fix for CVE-2024-52046 not applied)
https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9
Issue exists because of an incomplete fix for CVE-2024-52046