org.apache.mina:mina-core vulnerabilities

CVEs whose affected-version data names the org.apache.mina:mina-core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-118636Critical· 9.8

6d ago

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadge…

▾ MidnightApache Software Foundation · org.apache.mina:mina-coreEPSS 0.57%via CVEORG