CVE-2026-47065

A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the resolveProxyClass method allows for the deserialization of java.lang.reflect.Proxy objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.

Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.