CVE-2026-94301

critical · 9.8

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

9.8

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-09-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

References

https://lists.apache.org/thread/rzos6zds5x7obl8trkvznt1djw4f996p
https://lists.apache.org/thread/x4667tn5ozbvkc3wz87lhzogbfl0dczj

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-94301