EUVD-2026-114734

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636

The Apache MINA codec module (branch 3.0.0) contains an unsafe deserialization vulnerability in JavaNativeMessageDecoder . The component calls ObjectInputStream.readObject() on frame bytes without a class filter, allowing an attacker to execute a gadget-chain RCE when the application interacts wi...

PT-2026-134678

Name of the Vulnerable Software and Affected Versions Apache MINA version 3.0.0 Description The JavaNativeMessageDecoder in the codec module uses ObjectInputStream.readObject on frame bytes without implementing a class filter. This allows an attacker who can send data to an application using this...

CVE-2026-118636: Apache Software Foundation Apache MINA: **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...