Security CVEs in Apache MINA, Perl modules, and kernel mitigation notes

Several vulnerability reports landed on oss-security covering unsafe deserialization, a bundled library flaw, a kernel use-after-free mitigation tip, and multiple issues in a Perl web module. The disclosures center on remote code execution risks and decoder problems that affect untrusted input handling.

Apache MINA unsafe deserialization RCE

A critical remote code execution issue via unsafe deserialization (CWE-502) was reported in the unsupported Apache MINA 3.0 branch as CVE-2026-118636. The flaw sits in JavaNativeMessageDecoder. Users of that branch face potential exploitation when processing untrusted data and should treat the component as unmaintained.

XS::ibbrotli bundled brotli out-of-bounds write

XS::ibbrotli versions before 1.2.1.0 for Perl ship a brotli library containing an out-of-bounds write in the decoder, disclosed as CVE-2026-115946 and tied to CVE-2026-111497. Dependent modules that feed untrusted data to the decoder are affected. Perl developers relying on the package need to move to a fixed release.

init_on_free as interim kernel UAF mitigation

An oss-security post recommends enabling init_on_free=1 as an extra interim mitigation for the kernel use-after-free tracked as CVE-2026-98432. The option can reduce exposure while permanent fixes propagate. Administrators of affected kernels may evaluate the setting for short-term hardening.

WebDyne for Perl five CVEs

Five CVEs were announced for the WebDyne Perl module, spanning missing cookie flags, path traversal, and cross-site scripting. The module is little-known yet the flaws can impact any web application that depends on it. Operators should examine the reports and apply available updates.