CVE-2024-52046 – Apache MINA: MINA applications using unbounded deserialization may allow RCE

https://notcve.org/view.php?id=CVE-2024-52046

25 Dec 2024 — The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious serialized data, potentially leading to remote code execution (RCE) attacks. This issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10... • https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8 • CWE-94: Improper Control of Generation of Code ('Code Injection') •