CVE-2026-118636

Name of the Vulnerable Software and Affected Versions Apache MINA version 3.0.0

Description The JavaNativeMessageDecoder in the codec module uses ObjectInputStream.readObject() on frame bytes without implementing a class filter. This allows an attacker who can send data to an application using this decoder to execute arbitrary code on the system via a gadget-chain RCE (Remote Code Execution), which is a technique that leverages existing code fragments within an application to execute malicious commands.

Recommendations Migrate to the latest Apache MINA 2.2.X branch.