{"id":"UBUNTU-CVE-2026-47065","details":"ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc()  is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class — bypassing the accepted  classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s  (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*\") , attacker supplies com.myapp.SomeClass ) causes \u003cclinit\u003e of SomeClass — and many real-world classes have side-effecting static initialisers Both issues have been fixed.","modified":"2026-06-23T17:45:08.334743627Z","published":"2026-06-03T11:16:00Z","upstream":["CVE-2026-47065"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-47065"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-47065"}],"affected":[{"package":{"name":"mina2","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/mina2?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.4-2","2.1.5-1","2.1.5-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmina2-java","binary_version":"2.1.5-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47065.json"}},{"package":{"name":"mina2","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/mina2?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-3","2.2.1-3ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.1-3ubuntu0.1~esm1","binary_name":"libmina2-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47065.json"}},{"package":{"name":"mina2","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/mina2?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-3","2.2.1-4"],"ecosystem_specific":{"binaries":[{"binary_name":"libmina2-java","binary_version":"2.2.1-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47065.json"}},{"package":{"name":"mina2","ecosystem":"Ubuntu:Pro:26.04:LTS","purl":"pkg:deb/ubuntu/mina2?arch=source&distro=esm-apps%2Fresolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4","2.2.1-4ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmina2-java","binary_version":"2.2.1-4ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47065.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}