Cyber ·
CVE-2026-118636: unsafe deserialization in Apache MINA 3.0 rated critical
Advisory published on October 31, 2026 describes a critical (CVSS 3.1: 9.8) unsafe deserialization flaw in the JavaNativeMessageDecoder of Apache MINA 3.0.0 through 3.0.0-M2, which may allow remote code execution in applications exposed to untrusted peers.
According to the content made available in the oss-sec feed, flaw CVE-2026-118636 is rated critical, with CVSS 3.1 vector 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected versions are Apache MINA 3.0.0 through 3.0.0-M2. The text states that the JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without a class filter. An application that places this decoder in front of an untrusted peer may therefore be exposed to remote code execution through a gadget chain. The available excerpt says the 3.0.0 branch was unsupported at the time of assignment, but the rest of the text is truncated and should not be treated as complete guidance. Rota Nacional does not patch third-party libraries and does not solve this engineering problem. Organizations using MINA should identify affected applications, check the version in use, and follow the project's official guidance for upgrade or mitigation. The original is in the oss-sec feed named in the publication and should be consulted for the full text and fixed versions.