https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 03:24:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-47065 <p><strong>Affected:</strong> Apache Software Foundation Apache MINA</p> <p>ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy</p> <p>Assessment: Fully addressed.</p> <p>When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list .</p> <p>ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes</p> <p>Assessment: Fully addressed.</p> <p>For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*&#34;) , attacker supplies com.myapp.SomeClass ) causes &lt;clinit&gt; of SomeClass — and many real-world classes have side-effecting static initialisers</p> <p>Both issues have been fixed.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache MINA</p> <p>ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy</p> <p>Assessment: Fully addressed.</p> <p>When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list .</p> <p>ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes</p> <p>Assessment: Fully addressed.</p> <p>For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*&#34;) , attacker supplies com.myapp.SomeClass ) causes &lt;clinit&gt; of SomeClass — and many real-world classes have side-effecting static initialisers</p> <p>Both issues have been fixed.</p> https://vulnerability.circl.lu/vuln/cve-2026-47065