Deserialization in Apache MINA can trigger class resolution for java.lang.reflect.Proxy objects. The JDK’s resolver loads each listed interface with Class.forName without applying the Maven allow‑list, allowing an attacker to create a proxy that bypasses the intended restriction. Additionally, deserializing any class on the allow‑list activates its static initializer before any instance is created, so a malicious payload that names an allow‑listed class can execute arbitrary code during class loading or proxy creation. These flaws combined provide a high‑severity vector for remote code execution and data tampering.

Apache MINA libraries distributed by the Apache Software Foundation. No specific affected version information is supplied, so any deployment that has not applied the recent fix is potentially susceptible.

The CVSS score of 9.8 indicates a critical vulnerability, though no EPSS score was provided, so the exploitation probability cannot be quantified. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote deserialization of crafted data, which can be facilitated by an attacker who gains the ability to send arbitrary serialized streams to the application. If not prevented, an attacker could execute code with the privileges of the running process.