Apache MINA 3.0 milestone builds (3.0.0 to 3.0.0-M2): unsafe deserialization in JavaNativeMessageDecoder (CVE-2026-118636, CVSS 9.8); Apache says the inactive 3.0 branch will not get a fix and recommends the latest MINA 2.2.x
Apache's CVE record for CVE-2026-118636, published on 1 November 2026 (4:17 am Perth), is marked 'UNSUPPORTED WHEN ASSIGNED'.
It says JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain remote code execution. The record lists Apache MINA 3.0.0 through 3.0.0-M2 as affected, describes the severity as critical and gives a CVSS 3.1 base score of 9.8.
Apache says that as the 3.0.0 branch is inactive it does not plan to release a version that fixes the issue, and recommends users move to the latest Apache MINA 2.2.x branch; MINA's download page lists Apache MINA 2.2.10 as the stable release (Java 8+). (sources: CVE-2026-118636 record; Apache MINA downloads page)
- Product
- Apache MINA 3.0 codec module (JavaNativeMessageDecoder)
- Versions
- Apache MINA 3.0.0 through 3.0.0-M2 (per the CVE record); Apache does not plan a fix for the inactive 3.0.0 branch
- CVSS
- (CVSS 3.1, Apache CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Exploited in Australia?
- unknown
- Patch to
- Apache recommends moving to the latest Apache MINA 2.2.x branch (MINA's download page lists 2.2.10 as the stable release, as of 1 Nov 2026). Until you have moved, do not put a MINA 3.0 JavaNativeMessageDecoder in front of untrusted peers.