What is GHSA-gcvh-r85p-53mh?

GHSA-gcvh-r85p-53mh is a security advisory published by GitHub Security Advisories with Critical severity. **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls...

Which CVE IDs does GHSA-gcvh-r85p-53mh cover?

GHSA-gcvh-r85p-53mh covers the following CVE IDs: CVE-2026-118636. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gcvh-r85p-53mh?

GHSA-gcvh-r85p-53mh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-gcvh-r85p-53mhCriticalCVSS 9.8

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls...

Vendor

GitHub Security Advisories

Published

October 31, 2026

Last Modified

October 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-118636 →

📋 Description

UNSUPPORTED WHEN ASSIGNED

JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE.

As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.

Users are recommended to use the latest Apache MINA 2.2.X branch.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-118636
https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x
https://www.cve.org/CVERecord?id=CVE-2026-118636
http://www.openwall.com/lists/oss-security/2026/10/31/3
https://github.com/advisories/GHSA-gcvh-r85p-53mh