The vulnerability is a missing override of the resolveProxyClass method that allows an attacker to bypass the acceptMatchers allow‑list in Apache MINA, effectively enabling the execution of arbitrary code via a crafted java.lang.reflect.Proxy object. This flaw is classified as CWE‑502 and carries a CVSS score of 9.8, indicating that exploitation would likely lead to a complete loss of control over the affected system.

The Apache MINA 2.0.X and 2.1.X maintenance branches – in particular the 2.0.30 and 2.1.14 releases and any later builds on those lines – remain vulnerable because the patch was never incorporated into those branches. The library is distributed by the Apache Software Foundation.

The high CVSS score, combined with the report that no mitigating measures exist, positions this flaw as a critical risk. Based on the description, it is inferred that exploitation would occur when a MINA instance receives data over the network from an untrusted source, allowing the attacker to deliver a crafted Java object. The likely attack vector is transmission of this object to a MINA-based service that deserializes input. Although the EPSS score is not available and the vulnerability is not listed in KEV, operators should treat the vulnerability with the same priority as any remote code execution flaw.