CVE-2026-118636

{
  "etk_id": "ETK-2026-3197",
  "cve_id": "CVE-2026-118636",
  "display_id": "CVE-2026-118636",
  "ghsa_id": "GHSA-gcvh-r85p-53mh",
  "euvd_id": "EUVD-2026-114734",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe Java deserialization in Apache MINA 3.0",
  "summary": "Apache MINA 3.0 applications using the JavaNativeMessageDecoder are affected by unsafe deserialization of received frame data. An attacker may achieve code execution if they can send data through an application endpoint that passes traffic from an untrusted peer to this decoder.",
  "mitigation": "Move affected deployments to the latest Apache MINA 2.2.x release. Do not expose JavaNativeMessageDecoder to untrusted network peers while migration is in progress.",
  "vendor": "Apache Software Foundation",
  "product": "Apache MINA",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, <= 3.0.0-M2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "org.apache.mina:mina-core",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.97204371666667,
  "t0_at": "2026-10-31T20:17:11.191000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-31T20:17:11.191000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T20:17:11.191000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-118636"
    }
  }
}