Re: Apache MINA 2.0.12 and 2.2.7 release

[Gary Gregory <ga...@gmail.com>]

Nicely done on the speedy release Emmanuel!

Gary

On Thu, Apr 30, 2026, 17:53 Emmanuel Lecharny <el...@apache.org> wrote:

> The Apache MINA project is pleased to announce the release of:
> - Apache MINA 2.2.7
> - Apache MINA 2.1.12
>
> This is a security release that fixes 2 CVE that were supposed to have
> been fixed in the previous release, but the code never made it to
> those two branches due to a mistake.
>
> - CVE-2026-42778: Apache MINA: CWE-502 Deserialization of Untrusted
> Data (https://www.cve.org/CVERecord?id=CVE-2026-42778)
>
>
> - CVE-CVE-2026-42779: Apache MINA: AbstractIoBuffer.resolveClass()
> null-clazz Branch Skips acceptMatchers Filter — Full Object
> Deserialization RCE (https://www.cve.org/CVERecord?id=CVE-2026-42779)
>
> It affects the applications that use the AbstractIoBuffer.getObject()
> method to deserialize the Java classes that are sent by a client.
>
> Those applications should upgrade to the released version.
>
> Information relative to these releases are available on the following page:
>
> https://mina.apache.org/mina-project/news
>
> Downloads are available at
> https://mina.apache.org/downloads-mina_2_1.html
> https://mina.apache.org/downloads-mina_2_2.html
>
> The Apache MINA PMC
>
> --
> Regards,
> Cordialement,
> Emmanuel Lécharny
> www.worteks.com
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
> For additional commands, e-mail: dev-help@mina.apache.org
>
>