9.8
CriticalCVSS 3.1 · from apache
CVE-2026-118636
Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
org.apache.mina:mina-core · Unsafe deserialization · CWE-502Affectedorg.apache.mina:mina-core
FixNo fix listed yet.
PublishedOct 31, 20:17 · apache
ScoredOct 31 · 9.8 · apache
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
From apache
Affected and fixed versions
ProductAffectedFixed inorg.apache.mina:mina-core3.0.0 – 3.0.0-M2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known