CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

Summary by Cyber Security News21 Sep 2026, 19:04 CEST

About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/847

Posted by Emmanuel Lécharny on Sep 21 Severity: Affected versions: - Apache MINA (org.apache.mina:mina-filter-compression) 2.2.0 before 2.2.8 - Apache MINA (org.apache.mina:mina-filter-compression) 2.1.0 before 2.1.13 - Apache MINA (org.apache.mina:mina-filter-compression) 2.0.0 before 2.0.29 Description: The CompressionFilter class uses ZLib to deflate and inflate data sent and received.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

MongoDB Security Advisory (AV26-945)

CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

Exim security advisory (AV26-944)