This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-118636 →
Unrated
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class...
UBUNTU-CVE-2026-118636
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Ubuntu:16.04:LTS | mina |
All versions |
— |
| Ubuntu:16.04:LTS | mina2 |
All versions |
— |
| Ubuntu:18.04:LTS | mina |
All versions |
— |
| Ubuntu:18.04:LTS | mina2 |
All versions |
— |
| Ubuntu:20.04:LTS | mina |
All versions |
— |
| Ubuntu:20.04:LTS | mina2 |
All versions |
— |
| Ubuntu:22.04:LTS | mina |
All versions |
— |
| Ubuntu:Pro:22.04:LTS | mina2 |
All versions |
— |
| Ubuntu:24.04:LTS | mina |
All versions |
— |
| Ubuntu:Pro:24.04:LTS | mina2 |
All versions |
— |
| Ubuntu:26.10 | mina2 |
All versions |
— |
| Ubuntu:Pro:26.04:LTS | mina2 |
All versions |
— |
Original description The description as published by the source.
UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- report ubuntu.com
- report cve.org
- report lists.apache.org
- report openwall.com