# CVE-2026-47065: mina2: ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy   Assessment:...

CVE-2026-47065 is fixed in mina2 on 1 platform by DEBIAN-CVE-2026-47065 (version 2.2.9-1), released June 3, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-47065
- Priority: Urgent
- CVSS: 9.8 (critical)
- EPSS: 0.0050
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 3, 2026

## Description

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy   Assessment: Fully addressed.   When the serialised stream contains a TC_PROXYCLASSDESC (the marker  for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc()  is dispatched. JDK then calls the default  ObjectInputStream.resolveProxyClass(interfaces) implementation, which  performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH  interface name and constructs the proxy class — bypassing the accepted  classes list .   ZDRES-233: Class.forName(name, initialize=true, classLoader) in  readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes   Assessment: Fully addressed.   For ANY class on the allow-list, deserialising a stream that names it triggers the class’s   (static initialiser) BEFORE any instance is constructed. This means an  attacker who supplies a class name on the allow-list (e.g., the  developer wrote accept(“com.myapp.*") , attacker supplies  com.myapp.SomeClass ) causes <clinit> of SomeClass — and many  real-world classes have side-effecting static initialisers   Both issues have been fixed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | mina2 Debian 14 | 2.2.9-1 | [DEBIAN-CVE-2026-47065](https://patchblox.com/security/data/fix/linux/debian-cve-2026-47065.md) | Jun 3, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.