9.8
Critical
CVE-2026-118636 **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…
Description
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache MINA 3.0 | 3.0.0 → 3.0.0-M2 | No fix stated |
References
- www.cve.org www.cve.org
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache MINA
The 11 CVEs of Apache MINA →
CVE-2026-94301
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via…
9.8
Critical
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received
7.5
High
CVE-2026-47065
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully…
9.8
Critical
CVE-2026-42778
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches
9.8
Critical