Apache MINA CVE-2026-118636

Exploitable only when an application wires the Apache MINA 3.0 codec module's JavaNativeMessageDecoder into a filter chain facing an untrusted peer; that decoder calls ObjectInputStream.readObject() on frame bytes with no class filter. Achieving RCE additionally requires a usable deserialization gadget chain on the application's classpath. Scope is limited to Apache MINA 3.0.0 through 3.0.0-M2 - a milestone of the inactive, unsupported 3.0 branch - so it does not affect default deployments that omit this decoder and is not present in the recommended 2.2.X branch. The flaw is not fixed; the only complete remediation per the vendor is migrating to the latest 2.2.X release.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes textbook network, unauthenticated, no-interaction deserialization RCE with full confidentiality, integrity and availability impact - the maximum-severity profile. However, the real-world priority signals are weak and incomplete: the vuln.today Decision label is 'awaiting_data', there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis. The CVSS vector describes severity, not likelihood of deployment: exploitation is gated by an application-specific choice to place JavaNativeMessageDecoder in front of an untrusted peer, a condition the vector does not capture and which conflicts with the 'trivial AC:L/PR:N' reading. The affected code is also an 'UNSUPPORTED WHEN ASSIGNED' milestone (3.0.0 through 3.0.0-M2) of an inactive branch the ASF will not fix, which narrows exposure to the small set of deployments running that pre-release and using the Java-native codec. Net: high theoretical severity, but current evidence (no KEV, no EPSS, no confirmed PoC, awaiting_data) does not establish widespread or active exploitation - treat as a serious code-execution flaw to remediate by migration, not a confirmed mass-exploitation emergency, and reassess if exploitation signals appear.

An application built on Apache MINA 3.0.0-M2 exposes a network service whose filter chain uses the codec module's JavaNativeMessageDecoder to parse incoming frames from untrusted clients. A remote attacker connects and sends a crafted message frame containing a malicious serialized Java object; the decoder calls ObjectInputStream.readObject() with no class filter, and if a suitable gadget chain is present on the classpath this yields arbitrary code execution. No public exploit code is identified at time of analysis, though the deserialization pattern is well understood.