Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1119
_____________________________________________________________________

DATE                : 03/11/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache MINA versions 3.0.0 up
                            to and including 3.0.0-M2.

====================================================================
https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x
_____________________________________________________________________

CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in
JavaNativeMessageDecoder

Severity: critical 
    CVSS 3.1: 9.8 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions:

- Apache MINA 3.0.0 through 3.0.0-M2

Description:

**UNSUPPORTED WHEN ASSIGNED** 

JavaNativeMessageDecoder in the MINA 3.0 codec module calls
ObjectInputStream.readObject() on frame bytes with no class filter,
so an application that puts it in front of an untrusted peer is open
to gadget-chain RCE.

As the 3.0.0 branch is inactive, we do not plan to release a version
that fixes this issue. 

Users are recommended to use the latest Apache MINA 2.2.X branch.

Credit:

Nguyen Cuong (cuongbeo090704@gmail.com) (reporter)

References:

https://www.cve.org/CVERecord?id=CVE-2026-118636
https://mina.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118636


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================