High 8.9Published Feb 25, 2026

CVE-2026-27727mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Updated under an hour ago (Oct 27, 2026, 2:30 PM ET)

Does this affect you?

It affects swaldman mchange-commons-java and 10 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for swaldman mchange-commons-java

Exploited in the last 30 days

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.

CVSS: 8.9 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE): CWE-74, CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

swaldman mchange-commons-java swaldman:mchange_commons_java (from the name)	before 0.4.0	CNA record
Red Hat Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11 redhat:apache_camel_spring_boot	from commons-java not affected	CISA ADP
Red Hat Red Hat Build of Debezium 3.2 redhat:debezium	from commons-java not affected	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 redhat:jboss_enterprise_application_platform	from commons-java not affected	CISA ADP
Red Hat Red Hat Satellite 6.16 for RHEL 8 redhat:satellite	from 0:4.4.25-1.el8sat not affected	CISA ADP
Red Hat Red Hat build of Apache Camel - HawtIO 4 redhat:apache_camel_hawtio	4	CISA ADP
Red Hat Red Hat Fuse 7 redhat:jboss_fuse	7	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp	Versions not stated	CISA ADP
Red Hat Red Hat Process Automation 7 redhat:jboss_enterprise_bpms_platform	7	CISA ADP
Red Hat streams for Apache Kafka 2 redhat:amq_streams	2	CISA ADP
1–10 of 11

References

References

https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44	x-refsource-confirm, patch, vendor-advisory
https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal	x-refsource-misc, exploit, third-party-advisory
https://www.mchange.com/projects/c3p0/#configuring_security	x-refsource-misc, issue-tracking
https://www.mchange.com/projects/c3p0/#security-note	x-refsource-misc, release-notes
https://access.redhat.com/errata/RHSA-2026:14873
https://access.redhat.com/errata/RHSA-2026:14874
https://access.redhat.com/errata/RHSA-2026:18054
https://access.redhat.com/errata/RHSA-2026:18055
https://access.redhat.com/errata/RHSA-2026:18059
https://access.redhat.com/errata/RHSA-2026:34365
1–10 of 15

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.