---
id: "CVE-2026-118636"
kind: "vulnerability"
aliases: ["CVE-2026-118636"]
title: "Apache MINA 3.0 codec: Java deserialization lets a peer run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-mina", "deserialization", "java", "package"]
not_affected_if: ["mina-2.2.x", "not-using-javanativemessagedecoder", "trusted-peers-only"]
published_at: "2026-10-31T21:16:53+00:00"
first_seen_at: "2026-10-31T21:37:09+00:00"
updated_at: "2026-10-31T21:39:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118636", "first_seen_at": "2026-10-31T21:37:09+00:00"}]
---

# Apache MINA 3.0 codec: Java deserialization lets a peer run code

The JavaNativeMessageDecoder in the Apache MINA 3.0 codec module passes incoming frame bytes to ObjectInputStream.readObject() with no class filter. An attacker who can send frames to an application using this decoder can use a gadget chain to execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `org.apache.mina` 3.0.x on the classpath or in the dependency tree (for example `mvn dependency:tree` or `gradle dependencies`).
- Check whether the application uses `JavaNativeMessageDecoder` from the MINA codec module.
- Check whether that decoder receives bytes from untrusted peers.

## Fix

- Apache MINA 3.0 branch: unknown; the sources say no fixed release is planned for the 3.0.0 branch.
- Users are recommended to use the latest Apache MINA 2.2.X branch.

## Timeline

- 2026-10-31T21:37:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118636

## From the sources

**UNSUPPORTED WHEN ASSIGNED** 

JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an
application that puts it in front of an untrusted peer is open to gadget-chain RCE.

As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. 

Users are recommended to use the latest Apache MINA 2.2.X branch.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_