CVE-2026-118636

Summary

The Apache MINA 3.0 JavaNativeMessageDecoder deserializes untrusted data via ObjectInputStream.readObject() without applying a class filter, enabling remote code execution through gadget chains.

Exploitability

Exploitation requires sending a specially crafted serialized object over the network to an application using the vulnerable decoder with no class filtering; it is straightforward for attackers with knowledge of Java deserialization gadgets.

Blast radius

Successful exploitation allows full compromise (remote code execution) of the affected server, potentially affecting all services relying on MINA 3.0 for network communication.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache MINA 2.2.X branch, as the 3.0.0 branch is inactive and no fixed version is available; if migration is not immediately possible, disable the JavaNativeMessageDecoder or apply a custom ObjectInputStream class filter before deserialization.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.