Apache MINA — unsafe deserialization.

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer…

WeaknessCWE-502: Unsafe deserialization

Published 31 Oct 2026, 21:16 UTCSource NVD

Read vendor advisory View on NVD

CVSS 3.1

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit chance, 30 days

Not scored yet

EPSS scores new CVEs within a day or two

Status

No known exploitation

Not in CISA KEV

Patch

Unknown

Check the vendor advisory

What happened

**UNSUPPORTED WHEN ASSIGNED**

JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an
application that puts it in front of an untrusted peer is open to gadget-chain RCE.

As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.

Users are recommended to use the latest Apache MINA 2.2.X branch.

What to do

01Check whether you run Apache MINA, and which version.
02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

31 Oct 21:16Published to NVD

Also actively exploited

Vendor

Apache44 CVEs in 30 days

All Apache CVEs

Other CVEs from Apache

40+ more CVEs

All Apache CVEs