L1nq0 opened a new pull request, #63:
URL: https://github.com/apache/mina/pull/63
The CVE-2026-47065 fix in 2.2.8 (commit 409171da) changed the form of a
serialized object on the wire: writeClassDescriptor now appends the full
standard Java serialization descriptor after the tag and class name, where
2.2.7 wrote only the tag and the name. Arrays, primitives and non-Serializable
classes are unchanged.
Object streams exchanged through IoBuffer.putObject / getObject are
therefore not interoperable across the 2.2.7 / 2.2.8 boundary, in either
direction. The same HashMap written by both versions:
```
2.2.7, 59 bytes
00000037aced000573720100116a6176612e7574696c2e486173684d617078703f4000000000000c770800000010000000017400016b7400017678
2.2.8, 114 bytes
0000006eaced000573720100116a6176612e7574696c2e486173684d617000116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017400016b7400017678
```
A 2.2.7 stream read by 2.2.8 or 2.2.9 fails with a BufferDataException
wrapping an EOFException. A 2.2.8 stream read by 2.2.7 fails with a
BufferDataException wrapping a StreamCorruptedException (invalid type code:
00). Same-version reads succeed on both sides. Reproduced with mina-core 2.2.7
/ 2.2.8 / 2.2.9 from Maven Central on JDK 8, using a plain HashMap written with
IoBuffer.putObject and read back with getObject after accept("java.util.*").
Mixed-version deployments hit this during rolling upgrades, and payloads
queued or persisted before an upgrade become unreadable after it. The format
change is not mentioned in the release announcement or the advisory, so users
applying the security upgrade get no signal that persisted or in-flight
payloads will break.
This change documents the format where users will look for it: the full
statement on IoBuffer.putObject, a pointer on both getObject overloads. The
same format change is present on the 2.1.x and 2.0.x branches (first released
in 2.1.13 and 2.0.29); I verified the behavior on the 2.2.x line only. I can
provide backports of this note to the other branches, and the small test
program, if that helps.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
