CVE-2019-0231 Apache MINA SSLFilter security Issue

What is CVE-2019-0231?

CVE-2019-0231 is a high-severity vulnerability in Apache MINA, published on 1 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

Weakness: CWE-319

Which versions are affected by CVE-2019-0231?

4 open source packages ship an affected version, including org.apache.mina:mina-core. It affects 1 product.

Products include Apache Mina.

How do I fix CVE-2019-0231?

Upgrade org.apache.mina:mina-core to a fixed version for your release line: 2.0.21 or 2.1.1.

Is CVE-2019-0231 being exploited?

There is no known exploitation of CVE-2019-0231 in the wild and no public exploit code.

Other vulnerabilities in Apache MINA

• CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE Critical 10.0
• CVE-2026-47065 Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 Critical 9.8
• CVE-2026-42778 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) Critical 9.8
• CVE-2026-42779 Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix) Critical 9.8
• CVE-2026-41409 Apache MINA: CWE-502 Deserialization of Untrusted Data Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-0231, GHSA-5h29-qq92-wj7f, ROOT-APP-MAVEN-CVE-2019-0231, UBUNTU-CVE-2019-0231.