{"id":"CVE-2026-118636","published":"2026-10-31T21:16:53.203","lastModified":"2026-10-31T21:16:53.203","description":"**UNSUPPORTED WHEN ASSIGNED** \n\nJavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an\napplication that puts it in front of an untrusted peer is open to gadget-chain RCE.\n\nAs the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. \n\nUsers are recommended to use the latest Apache MINA 2.2.X branch.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118636","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/31/3","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Apache MINA 3.0 JavaNativeMessageDecoder deserializes untrusted data via ObjectInputStream.readObject() without applying a class filter, enabling remote code execution through gadget chains.","exploitability":"Exploitation requires sending a specially crafted serialized object over the network to an application using the vulnerable decoder with no class filtering; it is straightforward for attackers with knowledge of Java deserialization gadgets.","blast_radius":"Successful exploitation allows full compromise (remote code execution) of the affected server, potentially affecting all services relying on MINA 3.0 for network communication.","remediation":"Upgrade to Apache MINA 2.2.X branch, as the 3.0.0 branch is inactive and no fixed version is available; if migration is not immediately possible, disable the JavaNativeMessageDecoder or apply a custom ObjectInputStream class filter before deserialization.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","mina","gadget-chain","untrusted-input"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:47:35.144Z"}}