by Kastro
Paper/Archive/CVE-2026-118636

CVE-2026-118636

Apache Software Foundation Apache MINA — Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

CVSS 9.8
critical.is priorityof 100
29
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

**UNSUPPORTED WHEN ASSIGNED**  JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

Affected

ProductAffectedFixed inSource
Apache MINA3.0.0 – 3.0.0-M2–CNA

Scores by source

apache (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

writeupcve.org/CVERecord?id=CVE-2026-118636advisorylists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x