CVE-2026-118636

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

CRITICAL 9.8

CVSS 3.1Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublished: 2026-10-31 20:17 UTCUpdated: 2026-10-31 21:08 UTCAssigner: apache

Description

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

CWE

CWE-502

Affected

Apache Software Foundation Apache MINA

References

https://www.cve.org/CVERecord?id=CVE-2026-118636third-party-advisory
https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7xvendor-advisory

View on CVE.org