Apache MINA Releases Bound Zlib Decompression
Tech GuruQuick Answer
CVE-2026-47321 affects Apache MINA's mina-filter-compression component in the version ranges below. Its CompressionFilter can allocate unbounded memory while expanding incoming compressed data. Upgrade to the fixed release for the installed branch and configure decompression limits; installing the dependency is not the entire application change.
Confirm Scope And Apply The Supported Fix
What to do now: Locate applications using MINA's inbound CompressionFilter, update to 2.0.29, 2.1.13, or 2.2.8 for the matching branch, configure an application-appropriate decompressed-size limit, and validate normal traffic and limit-exceeded handling outside production.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache MINA 2.0.0–2.0.28, 2.1.0–2.1.12, and 2.2.0–2.2.7 |
|---|---|
| Advisory | CVE-2026-47321 |
| CVE | CVE-2026-47321 |
| CVE record publication | 2026-09-21 07:43:24.769 UTC |
| Recorded CVE revision (historical snapshot) | 2026-09-21 14:00:48.113 UTC |
| Affected versions | Apache MINA 2.0.0–2.0.28, 2.1.0–2.1.12, and 2.2.0–2.2.7 |
| Fixed version | Apache MINA 2.0.29 / 2.1.13 / 2.2.8 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Apache added maxDecompressedSize, supplied as the fourth constructor argument or through setMaxDecompressedSize; reaching the configured bound raises an exception. Optional maxDecompressRatio and decompressRatioMinSize controls limit expansion ratios while allowing small outputs that would otherwise cause false positives. The six-argument constructor and corresponding fluent setters expose those controls. Use the Apache advisory and the API for the chosen fixed release to integrate them. The source's fluent example contains a stray period and its numerical limits are examples, not validated limits for this application; this notice does not reproduce it as runnable code.
What To Validate Now
- Inventory. Locate Apache MINA 2.0.0–2.0.28, 2.1.0–2.1.12, and 2.2.0–2.2.7 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Confirm the deployed MINA branch, the compression-filter dependency, and whether untrusted compressed input reaches inbound decompression. A MINA dependency without that feature does not by itself establish this path.
- Remediate. Upgrade the matching branch and explicitly configure the decompressed-size bound. Decide whether the ratio and minimum-output-size controls are also appropriate, using the application's legitimate message sizes and failure-handling requirements.
- Validate. Build the application against the selected fixed dependency and test approved compressed messages, boundary handling, and resource use in a controlled test environment. Verify graceful handling of the limit exception; no such integration or runtime test was performed for this notice.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
An arbitrary copied threshold can reject valid application traffic or provide insufficient protection. Have the application owner select and test the limits, preserve a supported rollback plan, and retain the actual filter configuration with the deployed-version evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
