CVE-2026-94301

Apache MINA's AbstractIoBuffer.getObject()/getObject(ClassLoader) deserializes byte streams through an internal ObjectInputStream that enforces an application-configured 'acceptMatchers' class allow-list, but the override needed to close a related allow-list bypass -- resolveProxyClass(), which checks each java.lang.reflect.Proxy interface name against acceptMatchers before the proxy class is resolved -- was applied only to the 2.2.x release line. The 2.0.x and 2.1.x maintenance branches never received it, so on MINA 2.0.27 through 2.0.30 and 2.1.10 through 2.1.14 an attacker who can influence the deserialized byte stream can still obtain a dynamic proxy for interfaces the allow-list was configured to block, defeating the intended restriction. Depending on which proxy-capable classes are present on the application's classpath, this can be leveraged toward remote code execution.