Apache MINA: Unsafe deserialization in JavaNativeMessageDecoder

Summary

Apache MINA's codec module JavaNativeMessageDecoder passes incoming frame bytes to Java native deserialization (ObjectInputStream.readObject()) without a class filter. An unauthenticated remote attacker who can send data to a MINA 3.0 endpoint could use gadget chains to execute code on the server. The risk applies only to applications that use this decoder to receive input from untrusted peers. The 3.0.0 branch is inactive and no fix is planned.

Affected

• Apache MINA 3.0.0 through 3.0.0-M2 (according to the official CVE record; the range is not yet confirmed by Apache's advisory)
• Default configuration: unaffected
• Whether MINA 2.2.X contains the same decoder is not stated in the sources.

Fixed in

• No fix planned. Apache states that the 3.0.0 branch is inactive.
• Apache recommends the latest 2.2.X branch. The MINA homepage lists 2.2.10 as the latest release; check the current release page before upgrading.

Workaround

• Remove the MINA 3.0.x dependency or move the affected service to a 2.2.X release.
• Do not expose the MINA endpoint to untrusted networks; allow only known peers at the firewall.
• Stop passing untrusted bytes to native Java deserialization. Replace the decoder with a non-serialization format or add a strict ObjectInputFilter as a partial stop-gap (not a fix).

Exploitation

• Unknown whether the vulnerability is actively exploited.
• No public proof of concept found at the time of writing.
• Rapid7 lists no module.

Our recommendation

• Inventory all applications and dependencies that use mina-core 3.0.x, including transitive copies, and ask development or integration partners.
• Plan migration to a supported 2.2.X release, targeting 2.2.10 or later, because CVE-2026-42778 affected 2.2.0 to 2.2.6 and was fixed in 2.2.7.
• Restrict network access to the MINA service to known, authenticated peers until the upgrade is done.
• Priority: high if a MINA 3.0 service is reachable from outside the trusted network; medium if it is internal only and peers are authenticated.
• If Apache Camel with camel-mina is used, check CVE-2026-40473 as well.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-118636 www.cve.org
• oss-security posting by Apache MINA www.openwall.com
• Apache lists thread lists.apache.org
• MINA project homepage mina.apache.org
• MINA 2.2 downloads mina.apache.org
• VulDB entry 429544 vuldb.com
• CVE-2026-42778 (SentinelOne) www.sentinelone.com
• CVE-2026-40473 (Camel MINA, GitHub) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:20.