CVE-2026-118636

Name	CVE-2026-118636
Description	UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mina (PTS)	bookworm	1.1.7.dfsg-13	fixed
mina2 (PTS)	bookworm	2.2.1-3	fixed
	trixie	2.2.1-4	fixed
	forky, sid	2.2.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mina	source	(unstable)	(not affected)
mina2	source	(unstable)	(not affected)

- mina2 <not-affected> (Only affects the 3.x branch)
- mina <not-affected> (Only affects the 3.x branch)