CVE-2026-118636: Apache MINA 3.0 Codec Deserialization RCE

Executive Summary

CVE-2026-118636 is a critical unsafe deserialization flaw (CVSS 9.8) in the codec module of Apache MINA 3.0. The JavaNativeMessageDecoder class calls ObjectInputStream.readObject() on incoming frame bytes with no class filter. Any application that places this decoder in front of an untrusted peer is open to gadget-chain remote code execution.

The CVE is flagged UNSUPPORTED WHEN ASSIGNED: the MINA 3.0.0 branch is inactive, and the maintainers' advisory text indicates they do not plan to ship a fix for it.

Vulnerability Details

Technical Analysis

Java native serialization lets the byte stream choose which classes get instantiated. Without an allow-list (an ObjectInputFilter or a class-restricted stream), an attacker can send a crafted object graph that chains classes already on the application's classpath ("gadgets") into arbitrary code execution during readObject().

JavaNativeMessageDecoder reads each frame straight into ObjectInputStream.readObject(). Nothing validates the class names before they are resolved, so exploitation needs only the ability to send a frame to a service using this decoder.

Exploitability depends on the deployment: the application must wire JavaNativeMessageDecoder into a MINA filter chain reachable by an attacker, and a usable gadget chain must exist on the classpath.

Affected Environments

• Services built on the MINA 3.0 codec module that decode Java-serialized messages from network clients
• Internal RPC or messaging layers that assume peers are trusted but are reachable from less trusted segments

Applications on the supported MINA 2.x line were not named in the advisory text available at publication.

Remediation

1. Inventory — search dependency trees for mina-core / the MINA 3.0 codec module (mvn dependency:tree, gradle dependencies).
2. Stop using JavaNativeMessageDecoder on any listener that accepts connections from untrusted peers. Replace it with a schema-based codec (Protobuf, JSON, or a custom binary format).
3. If removal is not immediately possible, restrict network access to the listener, and set a JVM-wide deserialization filter (-Djdk.serialFilter=...) that allow-lists only the classes your protocol needs.
4. Migrate off the unsupported 3.0 branch — no upstream patch is expected.

Detection

• Look for unexpected child processes spawned by the Java service.
• Review logs for malformed frames or InvalidClassException / ClassNotFoundException spikes on MINA listeners.
• Monitor for outbound connections from the application host to unfamiliar addresses.

References

• NVD — CVE-2026-118636
• Apache MINA project