CVE-2026-118636: unsafe deserialization in the Apache MINA decoder allows remote code execution

What happened and what to do

The advisory, published by Emmanuel Lécharny on the oss-sec list on 31 October 2026, rates CVE-2026-118636 in Apache MINA as critical. The flaw is in the JavaNativeMessageDecoder of the MINA 3.0 codec module: the decoder calls ObjectInputStream.readObject() on frame bytes without any class filter. The CVSS 3.1 score is 9.8, with network vector, no privileges and no user interaction. Affected versions are Apache MINA 3.0.0 through 3.0.0-M2.

A company that uses this decoder in services exposed to untrusted clients or systems should treat the case as a priority. In practice, it must inventory which applications depend on MINA 3.0 and check whether any of them accept frames from external peers before validation. Because the advisory notes that the 3.0.0 branch had no support at the time of assignment, the response often means moving to a fixed version or removing native Java serialization from the flow, replacing it with a data format that does not deserialize Java objects. Meanwhile, access to the port can be restricted, an input filter added, and deserialization exceptions and anomalous connections monitored.

How the consultancy can help

Exposure diagnosis: survey of Apache MINA dependencies across systems, identification of points that receive data from untrusted peers, and risk assessment. Then a remediation plan with migration or isolation of the decoder, implementation of input filters and continuous monitoring.

Next step

If your organization uses Apache MINA in products or services, send a short description of the scenario, including the versions in use and the data entry points. Wendelmaques returns a scoped proposal with diagnosis, steps and timelines.