CVE-2026-118636— Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

Quick assessment

Affected

Apache Software Foundation Apache MINA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

分配时不受支持 MINA 3.0 编解码模块中的会在未启用类过滤器（class filter）的情况下，对帧字节调用。因此，若应用程序将其置于不可信的对等节点（peer）之前，将面临利用 gadget 链进行远程代码执行（RCE）的风险。由于 3.0.0 分支已不再维护，我们计划不再发布修复此问题的版本。建议用户改用最新的 Apache MINA 2.2.X 分支。

CVSS 9.8 · Critical Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache MINA	`3.0.0≤ 3.0.0-M2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

Source: CVE Program / CVE List V5

Vulnerability Description

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache MINA	3.0.0 ~ 3.0.0-M2	-

II. Public POCs for CVE-2026-118636

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118636

请登录查看更多情报信息。

Other References for CVE-2026-118636 (2)

https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-118636 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118636

IV. Related Vulnerabilities

Same product: Apache MINA

Same vendor: Apache Software Foundation

Same weakness: CWE-502