Apache MINA’s AbstractIoBuffer.resolveClass() implementation contains two branches; one for static classes or primitive types skips the classname allowlist entirely. This bypass allows an attacker to supply arbitrary class names in deserialized objects, leading to full object deserialization and remote code execution. The flaw is a classic deserialization vulnerability indexed as CWE‑502 and results in arbitrary code execution when a deserializer is invoked on untrusted input.

Affected versions are Apache MINA 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6. Any application that utilizes Apache MINA and calls IoBuffer.getObject() is potentially vulnerable, regardless of the environment in which it runs.

The CVSS score is 9.8, indicating critical severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can provide a serialized payload to IoBuffer.getObject() can exploit the flaw to execute arbitrary code. The vulnerability remains highly impactful, and although no public exploit has been documented, the implementation details make it straightforward for an attacker with network or local access to the deserialization endpoint to trigger remote code execution.