9.8
Critique
CVE-2026-118636 **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…
Description
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache MINA 3.0 | 3.0.0 → 3.0.0-M2 | Pas de correctif indiqué |
Références
- www.cve.org www.cve.org
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache MINA
Les 11 CVE de Apache MINA →
CVE-2026-94301
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via…
9.8
Critique
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received
7.5
Élevée
CVE-2026-47065
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully…
9.8
Critique
CVE-2026-42778
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches
9.8
Critique