Vulnerability · Published Oct 31, 2026 · Assigned by apache
CVE-2026-118636Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache MINA from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mina | no fix listed | UBUNTU-CVE-2026-118636 |
| Ubuntu:24.04:LTS | mina | no fix listed | UBUNTU-CVE-2026-118636 |
| Ubuntu:26.10 | mina2 | no fix listed | UBUNTU-CVE-2026-118636 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache MINA | 3.0.0 – through 3.0.0-M2 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H