CVE-2026-47321: Apache MINA CompressionFilter DoS Vulnerability

CVE-2026-47321 Overview

CVE-2026-47321 is a resource exhaustion vulnerability in the Apache MINA CompressionFilter class. The filter uses ZLib to inflate incoming data without enforcing any limit on the resulting buffer size. Attackers can send small, highly compressed payloads that expand to enormous sizes once inflated. Compression ratios exceeding 1,000 to 1 exhaust application memory and cause denial of service. The flaw is categorized as [CWE-409] (Improper Handling of Highly Compressed Data / decompression bomb). Applications built on Apache MINA that enable inbound compression are exposed to remote, unauthenticated attacks over the network.

Critical Impact
A remote attacker can transmit a small compressed payload that inflates into gigabytes of data, exhausting heap memory and crashing the target Apache MINA application without authentication or user interaction.

Affected Products

Apache MINA (versions using the CompressionFilter class prior to the fixed release)
Applications that instantiate CompressionFilter with compressInbound enabled
Downstream projects and services embedding vulnerable Apache MINA builds

Discovery Timeline

2026-09-21 - CVE-2026-47321 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-47321

Vulnerability Analysis

The CompressionFilter class in Apache MINA wraps ZLib to compress outbound and decompress inbound network traffic. When inflating incoming data, the filter allocates a buffer sized to hold the fully decompressed payload without validating the resulting length. An attacker can craft a compressed stream whose expansion ratio exceeds 1,000 to 1. A few kilobytes of malicious input can force the JVM to allocate gigabytes of heap memory. Memory exhaustion follows, producing OutOfMemoryError conditions that terminate the application or make it unresponsive to legitimate clients. The attack requires no authentication, no user interaction, and can be launched by any client capable of establishing a network session with the vulnerable service.

Root Cause

The defect is a classic decompression bomb weakness. The inflate routine trusts the compressed payload and does not compare the emerging output against any configurable ceiling. Neither an absolute maximum decompressed size nor a compression-ratio guard existed in prior releases. The fix introduces a maxDecompressedSize constructor parameter, plus optional maxDecompressRatio and decompressRatioMinSize parameters that throw an exception when limits are exceeded.

Attack Vector

Exploitation occurs over the network against any Apache MINA service that enables inbound compression on CompressionFilter. An attacker connects to the exposed endpoint and transmits a small, highly compressed frame constructed with a ZLib deflate ratio well above 1,000 to 1. The filter reads the frame, calls inflate, and allocates a buffer sized to the decompressed length. Because no ceiling is enforced, the JVM heap fills and the process fails.

No verified public exploit code is available. Refer to the Apache Thread Discussion and the Openwall OSS Security Mail for the maintainers' technical analysis.

Detection Methods for CVE-2026-47321

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Java heap space entries in application logs originating from org.apache.mina.filter.compression.CompressionFilter stack frames.
Sudden, sharp increases in JVM heap usage correlated with small inbound MINA session payloads.
Abnormal client sessions transmitting compressed frames with unusually high compression ratios relative to session baselines.
Service restarts, dropped MINA sessions, or thread-pool starvation without corresponding legitimate traffic volume.

Detection Strategies

Instrument the MINA pipeline to log the compressed input size and decompressed output size per frame, then alert when the ratio exceeds an established threshold.
Monitor JVM garbage collection metrics and full-GC frequency for services using CompressionFilter.
Correlate application crash events with recent inbound session activity to identify malicious source addresses.

Monitoring Recommendations

Enable JMX or Micrometer telemetry for heap allocation rates on all Apache MINA services and ship metrics to a central observability platform.
Ingest application and JVM logs into a security data lake and build detections for CompressionFilter exceptions and OOM conditions.
Baseline expected compression ratios per protocol and alert on deviations that suggest a decompression-bomb attempt.

How to Mitigate CVE-2026-47321

Immediate Actions Required

Upgrade Apache MINA to the fixed release that introduces the bounded CompressionFilter constructors.
Reconfigure every CompressionFilter instance to pass maxDecompressedSize as the fourth constructor argument, using a value appropriate to the protocol.
Optionally set maxDecompressRatio and decompressRatioMinSize to reject payloads whose compression ratio exceeds the ceiling once they pass the grace size (default 1 MB).
Restrict network exposure of MINA services to trusted clients where feasible, and enforce rate limiting at upstream proxies.

Patch Information

The Apache MINA maintainers added a maxDecompressedSize limit and ratio-based guards to CompressionFilter. The new constructor signature is public CompressionFilter(final boolean compressInbound, final boolean compressOutbound, final int compressionLevel, final int maxDecompressedSize). An extended constructor also accepts maxDecompressRatio and decompressRatioMinSize. Upgrade to the patched Apache MINA release and update all filter instantiations. See the Apache Thread Discussion for release details.

Workarounds

Disable inbound compression by constructing CompressionFilter with compressInbound set to false where the protocol permits it.
Terminate compressed traffic at an upstream proxy that enforces its own decompression size limits before payloads reach the MINA service.
Apply strict input size limits at the transport layer to reduce the maximum compressed frame an attacker can submit.

java

// Configuration example using the fluent API introduced by the fix
CompressionFilter compressionFilter = new CompressionFilter()
        .setCompressionLevel(Zlib.COMPRESSION_MAX)
        .setMaxDecompressedSize(1_000_000)
        .setMaxDecompressRatio(100)
        .setDecompressRatioMinSize(100_000);