CVE-2026-118636 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-118636 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-118636 is a critical remote code execution flaw in Apache MINA 3.0’s JavaNativeMessageDecoder. The decoder calls ObjectInputStream.readObject() on attacker-controlled frame bytes without a class filter, which can let a malicious peer trigger gadget-chain deserialization and run arbitrary code in your process. Although it is not known to be exploited in the wild and is not in CISA KEV, the severity is CVSS 9.8 and the impact is severe for any service that exposes this codec to untrusted traffic.

Important: the MINA 3.0.0 branch is inactive and the project states no fixed 3.0 release is planned. The recommended path is to move to the latest Apache MINA 2.2.X branch and remove or disable any use of the vulnerable decoder in front of untrusted peers.

Immediate Action

  • Stop exposing the vulnerable decoder to untrusted input immediately. If you cannot patch today, isolate the service behind a trusted network boundary or disable the affected codec path.
  • Upgrade away from MINA 3.0 as soon as possible. Follow the vendor guidance and move to the latest 2.2.X line: Apache MINA security advisory.
  • Rollback if needed: if your deployment recently adopted MINA 3.0 for this codec, revert to the last known safe build that does not use JavaNativeMessageDecoder on untrusted traffic.
  • Restrict network access to the affected service: allowlist client IPs, place it behind a VPN, or temporarily disable the endpoint.
  • Assume compromise if suspicious activity exists: review logs for unexpected deserialization errors, unusual process launches, or outbound connections from the service.

Affected Versions

  • org.apache.mina:mina-core 3.0.0 and other 3.0.x builds using JavaNativeMessageDecoder are vulnerable.
  • 3.0.0 branch is inactive; no fixed 3.0 release is planned.
  • org.apache.mina:mina-core 2.2.X is the recommended safe branch per vendor guidance, provided you are not using an equivalent unsafe deserialization path.
  • TODO: exact fixed version if your internal inventory identifies a downstream fork or repackaged artifact.

Resolution Guide

Java / Maven

mvn dependency:tree | grep -i mina
# Update to the latest 2.2.X release (replace TODO with your target version)
mvn versions:use-dep-version -Dincludes=org.apache.mina:mina-core -DdepVersion=TODO:2.2.X

Java / Gradle

./gradlew dependencies | grep -i mina

# build.gradle
dependencies {
    implementation("org.apache.mina:mina-core:TODO:2.2.X")
}

npm / yarn / pnpm (only if your app bundles a Java service or uses a wrapper package; otherwise not applicable)

npm ls | grep -i mina
yarn why mina-core
pnpm why mina-core

Python / pip / pipx (only if you vendor or invoke a Java service from Python tooling; otherwise not applicable)

pip list | grep -i mina
pipx list

Linux package managers (if MINA is shipped by a distro package in your environment)

apt list --installed | grep -i mina
yum list installed | grep -i mina
dnf list installed | grep -i mina

Docker

docker image ls | grep -i your-app
docker run --rm your-image:TODO sh -lc 'jar tf /app/*.jar | grep -i mina'

Config hardening

// Prefer a safe decoder path; do not place JavaNativeMessageDecoder in front of untrusted peers.
// Example: remove the codec from the pipeline or gate it behind trusted-only routing.
pipeline.remove("javaNativeMessageDecoder");

Minimal code fix example (if you maintain a fork or wrapper)

ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(frame));
// Add a strict class filter or replace Java serialization entirely.
in.setObjectInputFilter(info -> {
    Class<?> c = info.serialClass();
    if (c == null) return ObjectInputFilter.Status.UNDECIDED;
    return c.getName().startsWith("com.yourcompany.safe.") 
        ? ObjectInputFilter.Status.ALLOWED
        : ObjectInputFilter.Status.REJECTED;
});
Object obj = in.readObject();

Detection & Verification

Check whether you are vulnerable:

# Find MINA 3.0 in your dependency graph
mvn dependency:tree | grep -i "org.apache.mina:mina-core"
./gradlew dependencies | grep -i "org.apache.mina"

# Search code for the vulnerable decoder
grep -RIn "JavaNativeMessageDecoder\|readObject()" src/ .

# Inspect built artifacts
jar tf target/*.jar | grep -i "mina\|JavaNativeMessageDecoder"

Verify the fix:

# Confirm the dependency is now 2.2.X
mvn dependency:tree | grep -i "org.apache.mina:mina-core"

# Rebuild and retest
mvn clean test
./gradlew clean test

# Confirm the vulnerable class is no longer present in the runtime artifact
jar tf target/*.jar | grep -i "JavaNativeMessageDecoder"

Dependency scanners: run your usual SCA tool and confirm it no longer reports CVE-2026-118636. If your scanner supports policy rules, flag any use of Java deserialization on network input as a blocking issue.

Risk and Impact

If exploited, an attacker can send crafted frame bytes that deserialize into a malicious gadget chain, leading to remote code execution in the application process. That can mean data theft, service takeover, credential exposure, or lateral movement into internal systems. For solo developers and small teams, the blast radius can be especially large because a single exposed service or container may hold secrets, API keys, or production database access.

Keep reading