Apache MINA: Unsafe Deserialization in JavaNativeMessageDecoder (CVE-2026-118636)
Apache MINA versions 3.0.0 through 3.0.0-M2 are vulnerable to remote code execution due to unsafe deserialization in the JavaNativeMessageDecoder class.
CVE search metadata
CVE search record: CVE-2026-118636. KEV: no. Product: Apache MINA (3.0.0 through 3.0.0-M2). Brief: Apache MINA: Unsafe Deserialization in JavaNativeMessageDecoder (CVE-2026-118636). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-mina-deserialization/
Triage facts
Revision 1- Applicability
- Apache MINA (3.0.0 through 3.0.0-M2)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 09:42 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
Apache MINA versions 3.0.0 through 3.0.0-M2 contain a critical deserialization vulnerability (CVE-2026-118636) in the JavaNativeMessageDecoder component. The vulnerability exists because JavaNativeMessageDecoder calls ObjectInputStream.readObject() on frame bytes without a class filter. Applications using this decoder to process data from untrusted peers are susceptible to gadget-chain remote code execution.