CVE-2026-27727mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by wh…
Updated under an hour ago ()
Does this affect you?
It affects mchange_commons_java. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-74, CWE-502
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
mchange mchange_commons_java mchange:mchange_commons_java | before 0.4.0 | NVD |
References
- https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44patch, vendor-advisory
- https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascalexploit, third-party-advisory
- https://www.mchange.com/projects/c3p0/#configuring_securityissue-tracking
- https://www.mchange.com/projects/c3p0/#security-noterelease-notes
- https://access.redhat.com/errata/RHSA-2026:14873
- https://access.redhat.com/errata/RHSA-2026:14874
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:34365
- https://access.redhat.com/errata/RHSA-2026:3890
- https://access.redhat.com/errata/RHSA-2026:4285
- https://access.redhat.com/security/cve/CVE-2026-27727
- https://bugzilla.redhat.com/show_bug.cgi?id=2442671
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27727.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.