The JavaNativeMessageDecoder component in the Apache MINA 3.0 codec module insecurely deserializes data by calling ObjectInputStream.readObject() without applying any class filtering. This flaw allows remote attackers to execute arbitrary code via crafted input when the component is exposed to untrusted peers. The 3.0.0 branch is inactive and will not receive a fix. Users are advised to migrate to the supported Apache MINA 2.2.x branch.