CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
CriticalCVSS 9.8
EPSS 0.58%
- Published
- Updated
- Exploit status
- No public exploit known
Description
UNSUPPORTED WHEN ASSIGNED
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an
application that puts it in front of an untrusted peer is open to gadget-chain RCE.
As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.
Users are recommended to use the latest Apache MINA 2.2.X branch.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.mina/mina-core(Maven) | >= 3.0.0, <= 3.0.0-M2 | No fix listed |
| ubuntu/mina(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mina2(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mina(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/mina2(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/mina2(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/mina2(Ubuntu:26.10) | All versions | No fix listed |
References
- www.cve.org third-party-advisory
- lists.apache.org vendor-advisory
- www.openwall.com
- Ubuntu CVE tracker vendor-advisory
- Debian Security Tracker CVE-2026-118636 vendor-advisory