CVE-2026-118636: RCE in Apache MINA 3.0 with no fix

CVE-2026-118636 affects the codec module of Apache MINA 3.0, specifically the JavaNativeMessageDecoder class. The vulnerability lies in the ObjectInputStream.readObject() method that processes incoming frame bytes with no class filter. Applications that expose this decoder to untrusted peers are vulnerable to remote code execution via gadget-chain attack: an attacker who can send data to the decoder can execute arbitrary code on the system.

The CVSS score is 9.8 (critical). The vulnerability state is critical because the MINA 3.0.0 branch is officially inactive and Apache does not plan to release a version that fixes the problem. No verified public exploit is recorded in public data, but signals on social media (3 posts in the last 24 hours) confirm the vulnerability is being discussed by security operators and administrators.

For those managing applications that depend on MINA 3.0: immediately inventory affected environments, assess decoder exposure to untrusted peers, and plan an upgrade to the stable MINA 2.2.X branch as the only official mitigation. If immediate upgrade is not possible, implement network controls to limit access to interfaces that expose the codec. Verify with your application vendor whether your applications use MINA 3.0 and which version.