CVE-2026-47321

A flaw was found in Apache MINA's CompressionFilter class. A remote attacker could exploit this vulnerability by sending specially crafted compressed data. The CompressionFilter does not properly limit the size of decompressed data, which can lead to an uncontrolled increase in memory usage. This can result in memory exhaustion and a Denial of Service (DoS) for the application.

Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can exploit unbounded decompression to exhaust JVM heap memory, causing a complete denial of service across the hosting application without requiring elevated privileges. In Red Hat environments, exposure is limited to deployments where network services explicitly integrate Apache MINA's inbound compression filter into their transport pipeline. Applications and build tooling that do not configure inbound stream inflation or that restrict network endpoints to authorized clients significantly lower operational exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.