< Back

CVE-2026-118636

Updated on 31 Oct 2026

Severity

9.8 Critical severity

Details

CVSS score
9.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

UNSUPPORTED WHEN ASSIGNED

JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE.

As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.

Users are recommended to use the latest Apache MINA 2.2.X branch.

Details

Affected product:
Apache CXF , Apache Hadoop , Apache Maven , Apache Spark , Eclipse Jetty , Spring , Wildfly , activemq , artemis , camel , crash , directory-kerby , directory-ldap-api , directory-server , flume , hbase , ignite , karaf , kite , logging-flume , logging-flume-irc , mina , mina-ftpserver , mina-sshd , org.apache.directory.server:apacheds-protocol-changepw , pulsar , quickfixj , shared
Affected packages:
mina-core @ 2.0.4 (+9181 more)