Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-47065

Опубликовано: 03 июн. 2026
Источник: nvd
CVSS3: 9.8
EPSS Низкий

Описание

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy

Assessment: Fully addressed.

When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list .

ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes

Assessment: Fully addressed.

For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myap

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:mina:2.0.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:mina:2.1.13:*:*:*:*:*:*:*
cpe:2.3:a:apache:mina:2.2.8:*:*:*:*:*:*:*

EPSS

Процентиль: 40%
0.005
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-502

Связанные уязвимости

CVSS3: 9.8
ubuntu
2 месяца назад

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker s...

CVSS3: 9.8
debian
2 месяца назад

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter By ...

CVSS3: 9.8
github
2 месяца назад

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

EPSS

Процентиль: 40%
0.005
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-502