A flaw in Apache MINA’s AbstractIoBuffer.getObject() allowed an attacker to trigger the static initializer of a class before the class‑allowlist was applied. The unsafe deserialization of untrusted data enabled arbitrary code execution through crafted serialized payloads, compromising confidentiality, integrity, and availability of the affected system.

Apache MINA versions 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6 are vulnerable. Any application that calls IoBuffer.getObject() and receives data from an untrusted source may be impacted.

The CVSS score of 9.8 indicates a critical severity, and the absence of an EPSS rating suggests the data is not sufficiently provided to gauge daily exploitation probability. The vulnerability is not listed in CISA KEV, but its high CVSS score and the nature of deserialization flaws mean that exploitation is feasible if an attacker can supply crafted data. The likely attack vector is network‑based input that is deserialized by an application using MINA without prior validation.