UBUNTU-CVE-2026-118636: Critical severity ubuntu/mina vulnerability
UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Applications using JavaNativeMessageDecoder from the MINA 3.0 codec module in front of an untrusted peer are exposed. The issue arises because attacker-controlled frame bytes are passed to ObjectInputStream.readObject() without a class filter.
What does an attacker need to exploit this issue?
An attacker needs network access to an application endpoint that accepts untrusted frames through the affected decoder. No authentication or user interaction is required according to the supplied vector.
Is a fix planned for the affected MINA 3.0 branch?
No. The MINA 3.0.0 branch is inactive, and no fixed release is planned for it.
What should teams do if they use the affected decoder?
Move to the latest Apache MINA 2.2.X branch as recommended. Until migration is complete, do not place JavaNativeMessageDecoder in front of untrusted peers.