{"id":"CVE-2026-118636","kind":"vulnerability","aliases":["CVE-2026-118636"],"related":[],"title":"Apache MINA 3.0 codec: Java deserialization lets a peer run code","description":"**UNSUPPORTED WHEN ASSIGNED** \n\nJavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an\napplication that puts it in front of an untrusted peer is open to gadget-chain RCE.\n\nAs the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. \n\nUsers are recommended to use the latest Apache MINA 2.2.X branch.","summary":"The JavaNativeMessageDecoder in the Apache MINA 3.0 codec module passes incoming frame bytes to ObjectInputStream.readObject() with no class filter. An attacker who can send frames to an application using this decoder can use a gadget chain to execute code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-mina","deserialization","java","package"],"not_affected_if":["mina-2.2.x","not-using-javanativemessagedecoder","trusted-peers-only"],"how_to_check":"- Look for `org.apache.mina` 3.0.x on the classpath or in the dependency tree (for example `mvn dependency:tree` or `gradle dependencies`).\n- Check whether the application uses `JavaNativeMessageDecoder` from the MINA codec module.\n- Check whether that decoder receives bytes from untrusted peers.","fix":"- Apache MINA 3.0 branch: unknown; the sources say no fixed release is planned for the 3.0.0 branch.\n- Users are recommended to use the latest Apache MINA 2.2.X branch.","status":"open","published_at":"2026-10-31T21:16:53+00:00","first_seen_at":"2026-10-31T21:37:09+00:00","triaged_at":"2026-10-31T21:39:04+00:00","updated_at":"2026-10-31T21:39:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-31T21:39:04Z","model":"claude-haiku-5-5","output":{"fix":"- Apache MINA 3.0 branch: unknown; the sources say no fixed release is planned for the 3.0.0 branch.\n- Users are recommended to use the latest Apache MINA 2.2.X branch.","reach":"network","title":"Apache MINA 3.0 codec: Java deserialization lets a peer run code","impact":"high","summary":"The JavaNativeMessageDecoder in the Apache MINA 3.0 codec module passes incoming frame bytes to ObjectInputStream.readObject() with no class filter. An attacker who can send frames to an application using this decoder can use a gadget chain to execute code on the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-mina","deserialization"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Code runs on the server via gadget-chain deserialization","analyst_note":"Sources state no fix for 3.0.0 and recommend 2.2.X; confirm which 2.2.X version is safe and whether the NVD entry has a CVSS vector.","how_to_check":"- Look for `org.apache.mina` 3.0.x on the classpath or in the dependency tree (for example `mvn dependency:tree` or `gradle dependencies`).\n- Check whether the application uses `JavaNativeMessageDecoder` from the MINA codec module.\n- Check whether that decoder receives bytes from untrusted peers.","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-javanativemessagedecoder","trusted-peers-only","mina-2.2.x"],"who_is_affected":"Only applications that use the MINA 3.0 codec module's JavaNativeMessageDecoder and expose it to untrusted network peers are exposed. Applications on the 2.2.X branch or not using this decoder are not covered by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000764,"input_tokens":4209,"output_tokens":687,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118636':14A,17A '-2026':13A,16A '2.2':131C '3.0':3A,30B,73C '3.0.0':106C 'apach':1A,19B,28B,129C 'apache-mina':18B 'applic':51B,87C 'assign':68C 'attack':44B 'branch':107C,133C 'byte':36B,80C 'call':76C 'chain':59B,102C 'class':41B,83C 'code':11A,62B 'codec':4A,31B,74C 'cve':12A,15A 'decod':54B 'deseri':6A,21B 'execut':61B 'filter':42B,84C 'fix':119C 'frame':35B,48B,79C 'front':92C 'gadget':58B,101C 'gadget-chain':100C 'inact':109C 'incom':34B 'issu':121C 'java':5A,22B 'javanativemessagedecod':25B,69C 'latest':128C 'let':7A 'mina':2A,20B,29B,72C,130C 'modul':32B,75C 'objectinputstream.readobject':38B,77C 'open':98C 'packag':23B 'pass':33B 'peer':9A,96C 'plan':113C 'put':89C 'rce':103C 'recommend':124C 'releas':115C 'run':10A 'send':47B 'server':65B 'unsupport':66C 'untrust':95C 'use':52B,56B,126C 'user':122C 'version':117C 'x':132C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the MINA 3.0 codec module's JavaNativeMessageDecoder and expose it to untrusted network peers are exposed. Applications on the 2.2.X branch or not using this decoder are not covered by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T21:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118636","severity":null,"published_at":"2026-10-31T21:16:53+00:00","modified_at":"2026-10-31T21:16:53+00:00","first_seen_at":"2026-10-31T21:37:09+00:00","fetched_at":"2026-10-31T21:37:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}