Bug 2508526

Summary: CVE-2026-47065 apache-sshd: mina: Arbitrary Code Execution via Deserialization Bypass [fedora-all]
Product: [Fedora] Fedora Reporter: Rohit Keshri <rkeshri>
Component: apache-sshdAssignee: Mat Booth <mat.booth>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: java-sig-commits, mat.booth, msrb
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["0948ceed-de5b-42ca-b8ec-3a64e44d7a0d"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2484326    

Description Rohit Keshri 2026-07-29 19:09:10 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy


Assessment: Fully addressed.


When the serialised stream contains a TC_PROXYCLASSDESC (the marker 
for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc()
 is
dispatched. JDK then calls the default 
ObjectInputStream.resolveProxyClass(interfaces) implementation, which 
performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH 
interface name and constructs the proxy class — bypassing the accepted
 classes list .


ZDRES-233: Class.forName(name, initialize=true, classLoader) in 
readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes


Assessment: Fully addressed.


For ANY class on the allow-list, deserialising a stream that names it triggers the class’s 
 (static initialiser) BEFORE any instance is constructed. This means an 
attacker who supplies a class name on the allow-list (e.g., the 
developer wrote accept(“com.myapp.*") , attacker supplies 
com.myapp.SomeClass ) causes <clinit> of SomeClass — and many 
real-world classes have side-effecting static initialisers


Both issues have been fixed.