Severity: critical
CVSS 3.1: 9.8 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions:
- Apache MINA 3.0.0 through 3.0.0-M2
Description:
**UNSUPPORTED WHEN ASSIGNED**
JavaNativeMessageDecoder in the MINA 3.0 codec module calls
ObjectInputStream.readObject() on frame bytes with no class filter, so an
application that puts it in front of an untrusted peer is open to gadget-chain
RCE.
As the 3.0.0 branch is inactive, we do not plan to release a version that fixes
this issue.
Users are recommended to use the latest Apache MINA 2.2.X branch.
Credit:
Nguyen Cuong ([email protected]) (reporter)
References:
https://www.cve.org/CVERecord?id=CVE-2026-118636
https://mina.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118636
