Apache MINA 3.0.0 through 3.0.0-M2 unsafe deserialization (CVE-2026-118636)
Original title: CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
JavaNativeMessageDecoder calls ObjectInputStream.readObject() with no class filter; the issue was unsupported when assigned.
Apache MINA 3.0.0 through 3.0.0-M2 has unsafe deserialization in JavaNativeMessageDecoder, tracked as CVE-2026-118636. The decoder calls ObjectInputStream.readObject() on frame bytes without a class filter. An application that places it in front of an untrusted peer can face gadget-chain remote code execution. CVSS 3.1 is 9.8. The advisory says the flaw was unsupported when assigned; the snippet does not name a fix.
Unconfirmed: The feed snippet cuts off before stating a fix or the rest of the 3.0.0 branch status.
- The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- The weakness is CWE-502 in the MINA 3.0 codec module.
- Emmanuel Lécharny posted the report to oss-security on October 31.
Impact: Gadget-chain remote code execution from untrusted frames
| Product | Affected |
|---|---|
| Apache MINA | 3.0.0 through 3.0.0-M2 |
- 1.Avoid placing JavaNativeMessageDecoder in front of an untrusted peer.
- CVEs
- CVE-2026-118636
- Vendors
- Apache
- Products
- Apache MINA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118636 | — | — | — |
From the original article
Posted by Emmanuel Lécharny on Oct 31 Severity: critical CVSS 3. 1: 9. 8 (critical) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.