--- id: CVE-2026-47065 title: >- ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ),… summary: >- ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ),… severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-502 vendor: apache product: mina affected: - mina = 2.0.29 - mina = 2.1.13 - mina = 2.2.8 published: '2026-06-03' updated: '2026-06-30' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47065' references: - url: 'https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj' label: security@apache.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47065.json - url: 'https://access.redhat.com/security/cve/CVE-2026-47065' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2484326' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-47065' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47065' - url: 'https://access.redhat.com/errata/RHSA-2026:60247' - url: 'https://access.redhat.com/errata/RHSA-2026:60249' - url: 'https://access.redhat.com/errata/RHSA-2026:60248' - url: 'https://access.redhat.com/errata/RHSA-2026:60239' - url: 'https://access.redhat.com/errata/RHSA-2026:60251' - url: 'https://access.redhat.com/errata/RHSA-2026:60246' - url: 'https://access.redhat.com/errata/RHSA-2026:60250' - url: 'https://access.redhat.com/errata/RHSA-2026:60252' - url: 'https://access.redhat.com/errata/RHSA-2026:60259' - url: 'https://access.redhat.com/errata/RHSA-2026:60254' - url: 'https://access.redhat.com/errata/RHSA-2026:60256' tags: - nvd - csaf - vex - red-hat epss: 0.00763 epssPercentile: 0.53404 ingestedAt: '2026-07-01T09:50:45.925Z' patched: - openshift_developer_tools_and_services 4.12 - openshift_developer_tools_and_services 4.13 - openshift_developer_tools_and_services 4.14 - openshift_developer_tools_and_services 4.15 - openshift_developer_tools_and_services 4.16 - openshift_developer_tools_and_services 4.17 - openshift_developer_tools_and_services 4.18 - openshift_developer_tools_and_services 4.19 - openshift_developer_tools_and_services 4.20 - openshift_developer_tools_and_services 4.21 - openshift_developer_tools_and_services 4.22 --- ## Overview ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes of SomeClass — and many real-world classes have side-effecting static initialisers Both issues have been fixed. ## Affected - `mina = 2.0.29` - `mina = 2.1.13` - `mina = 2.2.8` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:60247** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.12 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60247) - **RHSA-2026:60249** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60249) - **RHSA-2026:60248** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60248) - **RHSA-2026:60239** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60239) - **RHSA-2026:60251** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60251) - **RHSA-2026:60246** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60246) - **RHSA-2026:60250** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.18 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60250) - **RHSA-2026:60252** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.19 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60252) - **RHSA-2026:60259** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.20 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60259) - **RHSA-2026:60254** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.21 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60254) - **RHSA-2026:60256** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.22 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60256) - **Red Hat VEX** · Low · affected: OpenShift Developer Tools and Services, Red Hat Single Sign-On 7 · no fix planned: OpenShift Developer Tools and Services, Red Hat Single Sign-On 7 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47065.json)