Apache MINA (3.0.0 Through 3.0.0-M2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/apache-mina-3.0.0-through-3.0.0-m2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 09:42:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache MINA: Unsafe Deserialization in JavaNativeMessageDecoder (CVE-2026-118636)https://feed.craftedsignal.io/briefs/2026-10-apache-mina-deserialization/Sat, 31 Oct 2026 09:42:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-mina-deserialization/Apache MINA versions 3.0.0 through 3.0.0-M2 are vulnerable to remote code execution due to unsafe deserialization in the JavaNativeMessageDecoder class.Apache MINA versions 3.0.0 through 3.0.0-M2 contain a critical deserialization vulnerability (CVE-2026-118636) in the JavaNativeMessageDecoder component. The vulnerability exists because JavaNativeMessageDecoder calls ObjectInputStream.readObject() on frame bytes without a class filter. Applications using this decoder to process data from untrusted peers are susceptible to gadget-chain remote code execution.

]]>criticaladvisory