CVE-2026-118636

CRITICAL 9.8

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

CWE	CWE-502
Vendor	apache software foundation
Product	apache mina
Published	Oct 31, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache mina

Be the first to know when new critical vulnerabilities affecting apache software foundation apache mina are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Apache Software Foundation / Apache MINA

3.0.0 ≤ 3.0.0-M2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cve.org: https://www.cve.org/CVERecord?id=CVE-2026-118636 lists.apache.org: https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x openwall.com: http://www.openwall.com/lists/oss-security/2026/10/31/3

Credits

🔍 Nguyen Cuong ([email protected])