Hi,

The following vulnerabilities were published for mina2.

CVE-2026-47065[0]:
| ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter
| Bypass via java.lang.reflect.Proxy   Assessment: Fully addressed.
| When the serialised stream contains a TC_PROXYCLASSDESC (the marker
| for a java.lang.reflect.Proxy ), JDK’s
| ObjectInputStream.readProxyDesc()  is dispatched. JDK then calls the
| default  ObjectInputStream.resolveProxyClass(interfaces)
| implementation, which  performs Class.forName(intf, false,
| latestUserDefinedLoader()) for EACH  interface name and constructs
| the proxy class — bypassing the accepted  classes list .
| ZDRES-233: Class.forName(name, initialize=true, classLoader) in
| readClassDescriptor Triggers Static Initialiser of Allow-Listed
| Classes   Assessment: Fully addressed.   For ANY class on the allow-
| list, deserialising a stream that names it triggers the class’s
| (static initialiser) BEFORE any instance is constructed. This means
| an  attacker who supplies a class name on the allow-list (e.g., the
| developer wrote accept(“com.myapp.*") , attacker supplies
| com.myapp.SomeClass ) causes <clinit> of SomeClass — and many
| real-world classes have side-effecting static initialisers   Both
| issues have been fixed.


CVE-2026-47321[1]:
| Unbounded Decompression Amplification DoS in Apache Mina Zlib.inflate


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-47065
https://www.cve.org/CVERecord?id=CVE-2026-47065
[1] https://security-tracker.debian.org/tracker/CVE-2026-47321
https://www.cve.org/CVERecord?id=CVE-2026-47321
[2] https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
mina2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139162@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre Gruet <pgt@debian.org> (supplier of updated mina2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 08 Aug 2026 06:59:20 +0200
Source: mina2
Architecture: source
Version: 2.2.9-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Pierre Gruet <pgt@debian.org>
Closes: 1135167 1135347 1139162
Changes:
 mina2 (2.2.9-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version 2.2.9:
     Fixes the following CVE:
     CVE-2026-41635:
     Apache MINA's AbstractIoBuffer.resolveClass() contains two branches,
     one of them (for static classes or primitive types) does not check
     the class at all, bypassing the classname allowlist and allowing
     arbitrary code to be executed.
     CVE-2026-41409:
     The fix for CVE-2024-52046 in Apache MINA
     AbstractIoBuffer.getObject() was incomplete. The classname allowlist
     of classes allowed to be deserialized was applied too late after a
     static initializer in a class to be read might already have been
     executed.
     CVE-2026-47065:
     ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter
     Bypass via java.lang.reflect.Proxy
     CVE-2026-47321:
     Unbounded Decompression Amplification DoS in Apache Mina Zlib.inflate
     (Closes: #1135167, #1135347, #1139162)
   * Refreshing patches
   * Raising Standards version to 4.7.4:
     - Removing Priority: optional, which is now defaults
   * Switching to debhelper-compat 14, removing misc: substvar
   * Removing unneeded versioned B-D
   * Raising d/watch version to 5
   * Installing the NOTICE.txt file of the Apache-2.0 license
   * Skipping ognl and jmx artifacts, as Debian-packaged ognl is too old
   * Updating build-dependencies and Maven rules
   * Defining runtime dependencies using maven:Depends substvar
Checksums-Sha1:
 03b7ebfbcd7c5dc4bd18b32f687a10195067742c 2209 mina2_2.2.9-1.dsc
 4eab987dd47bfa4342b2cfc08c741f3ed73aa9d7 403368 mina2_2.2.9.orig.tar.xz
 b365b756c34783c3c25f26925ad3bf52d629ea8e 8308 mina2_2.2.9-1.debian.tar.xz
 1920760744001f4de42e8ab04d3efccdf71ae9cb 15765 mina2_2.2.9-1_amd64.buildinfo
Checksums-Sha256:
 ed194ba15a5c4dec17454085cdf2294e65bf785c5bceb476c180f881c0ca029a 2209 mina2_2.2.9-1.dsc
 fc1d754b630cf2c50b9208db82c559b6f48fca1a03b439c4fca70545794c4851 403368 mina2_2.2.9.orig.tar.xz
 70753e7ad5befe1a716107f509f9dd2526a356e3d151d888d8a045a82ffd94a4 8308 mina2_2.2.9-1.debian.tar.xz
 6afee834d1b4650aa352d5663a5865da1c40f5e955a2bf274e69806419b7601d 15765 mina2_2.2.9-1_amd64.buildinfo
Files:
 49d6fd50abb62d55c2a48f8e969cd4e9 2209 java optional mina2_2.2.9-1.dsc
 0ff474174d6e51365962d2b76bf70115 403368 java optional mina2_2.2.9.orig.tar.xz
 a64fe2a6a6d2930a940cec6d0b65ef38 8308 java optional mina2_2.2.9-1.debian.tar.xz
 500b79b54debbea4eb91bf9b524d1049 15765 java optional mina2_2.2.9-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmp2uIgACgkQYAMWptwn
dHZNOQ//V6cuM967MXOn4houhjH/o7mYkSRtFdTCqCp1vSrLbqMbv53Nh0z6Py5H
M86aq690mTL3bLDLWrDz/tgsT4efEuEkny8ITQc6ULvbeItjYDxJ8oTBY5SDUb+1
kfK9yIoOX0JVSr8KoUOKaPw5nwsGEK3K8hh8V39P+z+4D+qyryfZanZ4jlD6BK9w
ncYlSKp3dnEs9tRdSlil1RXDIwxk94wXr7a1U5Jl2jJbt/C4ss5VC42xr5LVX0DC
ddPT4jojdcPjyBzBS6u7PGhpZjLfUKcuSmKWytP/Pg+wXL189c0jPnkL+x/xYN91
hn1/p/sUCWzyRZBDkAwz2kEwkj7Tun2PtLJDN56IhggEXn6k1ADR2H72UCOZ8RnC
7pX3yTzbNjYjbdquCd2LJ1sF7mC/++lfZ7eWoObhR7jEANuBVFd4VnjJvgq0xrla
INpxpD+0P6RGd6Wubxo8HckxsnpQsr1b2s7GxejC7P+JefEJG3mex+F+htiAVH5X
g8bmxZIWJqTY9RvelMHhhBu2l17kON3I10DRICtrFdG+qQmps+zqX51QZi+g0QJK
oTcqdWF1Yeb9CuUvbTbQPxvo5IxEGbAYGlJ9PWiri1qPDrw6WTNfuFzRaZe51s78
zmYNf50p96U8C/MctkmCm/xsZgc65cStRYKfVCMG8/WK5lE9amE=
=IUqb
-----END PGP SIGNATURE-----