L1nq0 commented on PR #63: URL: https://github.com/apache/mina/pull/63#issuecomment-5673170172
Thanks for taking a look, and yes, a note on the site would reach people who never open the javadoc. Since the warning and any backports will need exact version numbers, I ran the same check on the 2.1.x and 2.0.x release lines (Maven Central jars, JDK 21; outputs byte-identical to the JDK 8 runs in the description). The first releases carrying the new form are 2.1.13 and 2.0.29, so the version pairs for the notes are 2.2.7/2.2.8, 2.1.12/2.1.13 and 2.0.28/2.0.29. 2.0.28, 2.1.12 and 2.2.7 all write the same 59-byte stream, and 2.0.29, 2.0.30, 2.1.13, 2.1.15 and 2.2.8 all write the same 114-byte stream. Reads across each boundary fail in both directions with the same two failures as on 2.2.x: BufferDataException wrapping an EOFException one way, a StreamCorruptedException the other. 2.1.15 and 2.0.30 read streams from 2.1.13 and 2.0.29 fine and reject the older ones. I can open the same javadoc change against the 2.1.X and 2.0.X branches with the version numbers adapted, or paste both diffs here for you to apply, whichever is less work for you. For the site warning, draft wording in case it saves a minute: The fix for CVE-2026-47065 changed the form MINA writes for serialized objects exchanged through IoBuffer.putObject / getObject and ObjectSerializationCodecFactory: after the class name, the full standard Java serialization class descriptor is now written. Streams produced by 2.2.7, 2.1.12 or 2.0.28 and earlier cannot be read by 2.2.8, 2.1.13 or 2.0.29 and later, and streams produced by the newer releases cannot be read by the older ones. Arrays, primitives and non-Serializable classes are unaffected. Upgrades across this boundary fail with a BufferDataException wrapping an EOFException or a StreamCorruptedException, and payloads persisted before the upgrade become unreadable after it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
