Memory Exhaustion Vulnerability in Apache MINA CompressionFilter

CVE-2026-47321

What is CVE-2026-47321?

The CompressionFilter class in Apache MINA employs ZLib for handling data compression. This vulnerability arises during the inflation process of incoming compressed data, where the filter fails to control the resulting size of the uncompressed data, risking memory exhaustion. Without proper checks, data with high compression ratios can lead to excessive memory usage, potentially disrupting application performance. The fix introduces a control mechanism allowing developers to set maximum limits for decompressed data size and compression ratios. Implementing these parameters prompts the filter to throw exceptions when limits are exceeded, thereby safeguarding against excessive memory consumption. Upgrading and correctly configuring instances of CompressionFilter is strongly recommended to mitigate the associated risks.

References