CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
Published Oct 31, 2026
·Updated
UNSUPPORTED WHEN ASSIGNED
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE.
As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.
Users are recommended to use the latest Apache MINA 2.2.X branch.
Affected Software
12 affected components
ubuntu/mina*
ubuntu/mina2*
ubuntu/mina*
ubuntu/mina2*
ubuntu/mina*
ubuntu/mina2*
ubuntu/mina*
ubuntu/mina2*
ubuntu/mina*
ubuntu/mina2*
ubuntu/mina2*
ubuntu/mina2*
Event History
Oct 31, 2026
CVE Published
via MITRE·08:17 PM
Data Sourced
via MITRE·08:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Nov 3, 2026
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software