Live › vulnerability › CVE-2026-118636
The JavaNativeMessageDecoder in the Apache MINA 3.0 codec module passes incoming frame bytes to ObjectInputStream.readObject() with no class filter. An attacker who can send frames to an application using this decoder can use a gadget chain to execute code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 21:37 UTC. All times on this page are UTC.
Only applications that use the MINA 3.0 codec module's JavaNativeMessageDecoder and expose it to untrusted network peers are exposed. Applications on the 2.2.X branch or not using this decoder are not covered by the sources.
No product ranges from the sources yet.
org.apache.mina 3.0.x on the classpath or in the dependency tree (for example mvn dependency:tree or gradle dependencies).JavaNativeMessageDecoder from the MINA codec module.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
UNSUPPORTED WHEN ASSIGNED
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE.
As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.
Users are recommended to use the latest Apache MINA 2.2.X branch.
This page as .md · .json · in your agent: get_signal("CVE-2026-118636")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.