Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/1025612?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/1025612?format=api", "purl": "pkg:maven/org.apache.mina/mina-core@2.2.0", "type": "maven", "namespace": "org.apache.mina", "name": "mina-core", "version": "2.2.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.2.6", "latest_non_vulnerable_version": "2.2.7", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/356168?format=api", "vulnerability_id": "VCID-6wa8-9b93-rqae", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42778.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42778.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-42778", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00144", "scoring_system": "epss", "scoring_elements": "0.34249", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40466", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40536", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.4044", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40541", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40516", "published_at": "2026-05-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-42778" }, { "reference_url": "https://github.com/apache/mina", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/mina" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321", "reference_id": "2464321", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321" }, { "reference_url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0", "reference_id": "fhlx5k91hrkgyzh7yk1nghrn3k27gxy0", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-01T13:21:04Z/" } ], "url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0" }, { "reference_url": "https://github.com/advisories/GHSA-76h9-2vwh-w278", "reference_id": "GHSA-76h9-2vwh-w278", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-76h9-2vwh-w278" }, { "reference_url": "https://github.com/advisories/GHSA-995c-6rp3-4m4x", "reference_id": "GHSA-995c-6rp3-4m4x", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-995c-6rp3-4m4x" }, { "reference_url": "https://github.com/advisories/GHSA-f2wh-grmh-r6jm", "reference_id": "GHSA-f2wh-grmh-r6jm", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f2wh-grmh-r6jm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1104394?format=api", "purl": "pkg:maven/org.apache.mina/mina-core@2.2.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.mina/mina-core@2.2.7" } ], "aliases": [ "CVE-2026-42778", "GHSA-995c-6rp3-4m4x" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6wa8-9b93-rqae" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/354856?format=api", "vulnerability_id": "VCID-gbug-wxy7-n3f2", "summary": "Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.\n\n\n\n\nThe fix checks if the class is present in the accepted class filter before calling Class.forName(). \n\n\n\n\n\n\nAffected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and\n\n\n2.2.0 <= 2.2.5.\n\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\n\nApplications using Apache MINA are advised to upgrade.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41635.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41635.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41635", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00046", "scoring_system": "epss", "scoring_elements": "0.14011", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.32892", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.32866", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.32847", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.32916", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.32955", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.32971", "published_at": "2026-05-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41635" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41635", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41635" }, { "reference_url": "https://github.com/apache/mina", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/mina" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2026/04/27/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2026/04/27/4" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135167", "reference_id": "1135167", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135167" }, { "reference_url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm", "reference_id": "1l91w1mqsb3lwfd504fs045ylxntt2tm", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-27T12:26:05Z/" } ], "url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177", "reference_id": "2463177", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1089606?format=api", "purl": "pkg:maven/org.apache.mina/mina-core@2.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.mina/mina-core@2.2.6" } ], "aliases": [ "CVE-2026-41635", "GHSA-8297-v2rf-2p32" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gbug-wxy7-n3f2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/356169?format=api", "vulnerability_id": "VCID-pga9-7edm-puf3", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42779.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42779.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-42779", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00144", "scoring_system": "epss", "scoring_elements": "0.34249", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40466", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40516", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.4044", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40541", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.0019", "scoring_system": "epss", "scoring_elements": "0.40536", "published_at": "2026-05-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-42779" }, { "reference_url": "https://github.com/advisories/GHSA-8297-v2rf-2p32", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8297-v2rf-2p32" }, { "reference_url": "https://github.com/apache/mina", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/mina" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322", "reference_id": "2464322", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322" }, { "reference_url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0", "reference_id": "fhlx5k91hrkgyzh7yk1nghrn3k27gxy0", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-01T13:20:41Z/" } ], "url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0" }, { "reference_url": "https://github.com/advisories/GHSA-vf5j-865m-mq7c", "reference_id": "GHSA-vf5j-865m-mq7c", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vf5j-865m-mq7c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1104394?format=api", "purl": "pkg:maven/org.apache.mina/mina-core@2.2.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.mina/mina-core@2.2.7" } ], "aliases": [ "CVE-2026-42779", "GHSA-vf5j-865m-mq7c" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pga9-7edm-puf3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/14705?format=api", "vulnerability_id": "VCID-wgsh-kurb-h7e1", "summary": "Apache MINA Deserialization RCE Vulnerability\nThe `ObjectSerializationDecoder` in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious serialized data, potentially leading to remote code execution (RCE) attacks.\n\t\nThis issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4.\n\nIt's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the `ObjectSerializationCodecFactory` class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library.\n\nUpgrading will not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods:\n\n1. \n * Accept class names where the supplied ClassNameMatcher matches for deserialization, unless they are otherwise rejected.\n * `@param classNameMatcher` the matcher to use\n * / `public void accept(ClassNameMatcher classNameMatcher)`\n\n2. \n * Accept class names that match the supplied pattern for deserialization, unless they are otherwise rejected.\n * `@param` pattern standard Java regexp\n * / `public void accept(Pattern pattern)`\n\n3.\n * Accept the wildcard specified classes for deserialization, unless they are otherwise rejected.\n * `@param` patterns Wildcard file name patterns as defined by `{@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String) FilenameUtils.wildcardMatch}`\n * / `public void accept(String... patterns)`\n\nBy default, the decoder will reject *all* classes that will be present in the incoming data.\n\nNote: The FtpServer, SSHd and Vysper sub-project are not affected by this issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52046.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52046.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-52046", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99105", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.9912", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99119", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99116", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99113", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99111", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.9911", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99109", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99108", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.80138", "scoring_system": "epss", "scoring_elements": "0.99103", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.80406", "scoring_system": "epss", "scoring_elements": "0.9914", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.80406", "scoring_system": "epss", "scoring_elements": "0.99141", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.80406", "scoring_system": "epss", "scoring_elements": "0.99142", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.80406", "scoring_system": "epss", "scoring_elements": "0.99138", "published_at": "2026-05-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-52046" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52046", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52046" }, { "reference_url": "https://github.com/apache/mina", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "10.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/mina" }, { "reference_url": "https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "10", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "10.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-26T18:13:45Z/" } ], "url": "https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52046", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "10.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52046" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20250103-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "10.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20250103-0001" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2024/12/25/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "10.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2024/12/25/1" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091530", "reference_id": "1091530", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091530" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334067", "reference_id": "2334067", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334067" }, { "reference_url": "https://github.com/advisories/GHSA-76h9-2vwh-w278", "reference_id": "GHSA-76h9-2vwh-w278", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-76h9-2vwh-w278" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:1078", "reference_id": "RHSA-2025:1078", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:1078" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51688?format=api", "purl": "pkg:maven/org.apache.mina/mina-core@2.2.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-gbug-wxy7-n3f2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.mina/mina-core@2.2.4" } ], "aliases": [ "CVE-2024-52046", "GHSA-76h9-2vwh-w278" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wgsh-kurb-h7e1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/354859?format=api", "vulnerability_id": "VCID-zqgu-xa16-a7cx", "summary": "The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41409.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41409.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41409", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00046", "scoring_system": "epss", "scoring_elements": "0.14011", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.39684", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.39661", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.39729", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.39746", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.39664", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.39755", "published_at": "2026-05-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41409" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41409", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41409" }, { "reference_url": "https://github.com/apache/mina", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/mina" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135347", "reference_id": "1135347", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135347" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175", "reference_id": "2463175", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175" }, { "reference_url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9", "reference_id": "9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-27T12:21:46Z/" } ], "url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409", "reference_id": "CVE-2026-41409", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409" }, { "reference_url": "https://github.com/advisories/GHSA-76h9-2vwh-w278", "reference_id": "GHSA-76h9-2vwh-w278", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-76h9-2vwh-w278" }, { "reference_url": "https://github.com/advisories/GHSA-f2wh-grmh-r6jm", "reference_id": "GHSA-f2wh-grmh-r6jm", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f2wh-grmh-r6jm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1089606?format=api", "purl": "pkg:maven/org.apache.mina/mina-core@2.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.mina/mina-core@2.2.6" } ], "aliases": [ "CVE-2026-41409", "GHSA-f2wh-grmh-r6jm" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zqgu-xa16-a7cx" } ], "fixing_vulnerabilities": [], "risk_score": "10.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.mina/mina-core@2.2.0" }