As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
CVE-2026-118636 affects Apache MINA 3.0.0 through 3.0.0-M2 and describes unsafe deserialization in JavaNativeMessageDecoder, where ObjectInputStream.readObject() processes frame bytes without class filtering. Applications using MINA 3.0 in front of untrusted peers face remote code execution (RCE) risk through gadget-chain attacks.
Why it matters: Developers using Apache MINA 3.0 codec module with untrusted network input must immediately patch or disable JavaNativeMessageDecoder to prevent unauthenticated RCE.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
Apache MINA's JavaNativeMessageDecoder in versions 3.0.0 through 3.0.0-M2 contains an unsafe deserialization flaw that calls ObjectInputStream.readObject() without a class filter, enabling remote code execution (RCE) through gadget-chain attacks. The vulnerability affects applications that expose the decoder to untrusted peers.
Why it matters: Teams running Apache MINA 3.0.0 through 3.0.0-M2 in environments accepting untrusted network data face immediate RCE risk and should apply fixes or isolate affected systems from untrusted inputs.
- Source published
- First seen by Cybersecurity Tracker