{
  "cveId": "CVE-2026-47065",
  "url": "https://patchblox.com/security/cve/CVE-2026-47065",
  "summary": "CVE-2026-47065 is fixed in mina2 on 1 platform by DEBIAN-CVE-2026-47065 (version 2.2.9-1), released June 3, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "mina2: ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy   Assessment:...",
  "description": "ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy   Assessment: Fully addressed.   When the serialised stream contains a TC_PROXYCLASSDESC (the marker  for a java.lang.reflect.Proxy ), JDK\u2019s ObjectInputStream.readProxyDesc()  is dispatched. JDK then calls the default  ObjectInputStream.resolveProxyClass(interfaces) implementation, which  performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH  interface name and constructs the proxy class \u00E2\u20AC\u201D bypassing the accepted  classes list .   ZDRES-233: Class.forName(name, initialize=true, classLoader) in  readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes   Assessment: Fully addressed.   For ANY class on the allow-list, deserialising a stream that names it triggers the class\u2019s   (static initialiser) BEFORE any instance is constructed. This means an  attacker who supplies a class name on the allow-list (e.g., the  developer wrote accept(\u201Ccom.myapp.*\u0022) , attacker supplies  com.myapp.SomeClass ) causes \u003Cclinit\u003E of SomeClass \u00E2\u20AC\u201D and many  real-world classes have side-effecting static initialisers   Both issues have been fixed.",
  "published": "2026-06-03T11:16:19Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00504,
  "epssPercentile": 0.43348,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "mina2",
      "release": "Debian 14",
      "fixedVersion": "2.2.9-1",
      "fix": "DEBIAN-CVE-2026-47065",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-47065",
      "released": "2026-06-03T11:16:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}