Critical severity9.8NVD Advisory· Published Oct 31, 2026
CVE-2026-118636
CVE-2026-118636
Description
UNSUPPORTED WHEN ASSIGNED
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE.
As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.
Users are recommended to use the latest Apache MINA 2.2.X branch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <3.0.0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.