{"id":"CVE-2026-55153","aliases":["CLSA-2026-1786542819","CLSA-2026-1786594683","CLSA-2026-1788238245","EUVD-2026-41135","GHSA-h84g-69h7-mw6v","UBUNTU-CVE-2026-55153","USN-8642-1"],"status":"published","title":"mchange-commons-java contains elements susceptible to abuse via JNDI injection and \"deserialization gadgets\"","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00194,"percentile":0.09181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470","CWE-502"],"published":"2026-07-01T20:02:47Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Maven","package":"com.mchange:mchange-commons-java","fixed_in":["0.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.mchange:mchange-commons-java","fixed_in":["0.2.20-tuxcare.2","0.2.19-tuxcare.2","0.2.15-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-10ubuntu0.20.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-10ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-10ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-11ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.mchange:mchange-commons-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:mchange-commons-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.20"},{"fixed":"0.2.20-tuxcare.2"}]}],"versions":["0.2.20","0.2.20-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:mchange-commons-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.19"},{"fixed":"0.2.19-tuxcare.2"}]}],"versions":["0.2.19","0.2.19-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:mchange-commons-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.15"},{"fixed":"0.2.15-tuxcare.2"}]}],"versions":["0.2.15","0.2.15-tuxcare.1"]},{"source":"osv","ecosystem":"Maven","package":"com.mchange:mchange-commons-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"versions":["0.2.1-RELEASE","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.15","0.2.16","0.2.17","0.2.18","0.2.19","0.2.2","0.2.20","0.2.3","0.2.3.1","0.2.3.2","0.2.3.3","0.2.3.4","0.2.4","0.2.5","0.2.6","0.2.6.1","0.2.6.2","0.2.6.3","0.2.6.5","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.2","0.4.0","0.5.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2"}]}],"versions":["0.9.1.2-9","0.9.1.2-9+deb8u1build0.16.04.1","0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"}]}],"versions":["0.9.1.2-9","0.9.1.2-9+deb8u1build0.18.04.1","0.9.1.2-9+deb8u1ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu0.20.04.1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu2+esm1"}]}],"versions":["0.9.1.2-10ubuntu1","0.9.1.2-10ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-10ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-11ubuntu0.1~esm1"}]}],"versions":["0.9.1.2-10ubuntu2","0.9.1.2-11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"}]}],"versions":["0.9.1.2-9","0.9.1.2-9+deb8u1build0.18.04.1","0.9.1.2-9+deb8u1ubuntu0.18.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu0.20.04.1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu0.20.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu2+esm1"}]}],"versions":["0.9.1.2-10ubuntu1","0.9.1.2-10ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-11ubuntu0.1~esm1"}]}],"versions":["0.9.1.2-10ubuntu2","0.9.1.2-11"],"bundled":4}],"products":[{"vendor":"swaldman","product":"mchange-commons-java"}],"references":[{"url":"https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-h84g-69h7-mw6v","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55153","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h84g-69h7-mw6v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55153.json","tags":["advisory"]},{"url":"https://github.com/swaldman/mchange-commons-java","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-55153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55153","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8642-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55223","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-55153","title":"mchange-commons-java contains elements susceptible to abuse via JNDI injection and \"deserialization gadgets\"","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","status":"published","published":"2026-07-01T20:02:47.254Z","modified":"2026-07-06T14:02:08.977Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502","CWE-470"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-41135","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","status":"published","published":"2026-07-01T20:02:47Z","modified":"2026-07-06T14:02:08Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:13.541613Z"}],"ghsa":[{"id":"GHSA-h84g-69h7-mw6v","title":"mchange-commons-java contains elements susceptible to abuse via JNDI injection and \"deserialization gadgets\"","description":"### Impact\nPrior to version 0.6.0, mchange-commons-java includes a JNDI `ObjectFactory` implementation (`com.mchange.v2.naming.JavaBeanObjectFactory`) willing to construct objects of arbitrary classes and initialize \"JavaBean\"-style properties. There are classes for which this kind of initialization is unsafe. For example, setting the \"contentType\" property of a Swing `JEditorPane` to `text/html` and the \"text\" property to HTML containing a stylesheet \u0026lt;link\u0026gt; will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. This issue is aggravated by mchange-commons-java's `ReferenceIndirector`, by which malicious JNDI `Reference` objects could be smuggled in for dereferencing by applications anywhere a Java-serialized object might be read. \n\nPrior to version 0.5.0, the same mchange-commons-java `ObjectFactory` would interpret `BinaryRefAddress` elements as Java-serialized objects, and deserialize unexpected objects that potentially execute malicious behavior on initialization. Although this author is unaware of any code within mchange-commons-java itself that can be abused to execute code on deserialization, this mechanism can be used to trigger well-known \"deserialization gadget chains\" involving other libraries. For example, in JVMs prior to Java 16 with Apache libraries [`commons-beanutils`](https://commons.apache.org/proper/commons-beanutils/) and [`commons-collections`](https://commons.apache.org/proper/commons-collections/) on the application `CLASSPATH`, [objects can be crafted](https://gist.github.com/frohoff/9eb8811761ff989b3ac0) that will execute arbitrary commands on deserialization. (Thanks to Valerio Mulas for a proof-of-concept.)\n\n### Patches\nmchange-commons-java v0.5.0 eliminates all support for deserializing Java objects in `com.mchange.v2.naming.JavaBeanObjectFactory`, unless an application explicitly extends that class to restore it. This prevents mchange-commons-java from enabling JNDI injection to trigger common \"deserialization gadgets\".\n\nmchange-commons-java v0.6.0 imposes a whitelist upon what classes `com.mchange.v2.naming.JavaBeanObjectFactory` consents to materialize, preventing the use of maliciously constructed `Reference` instances to initialize arbitrary, potentially malicious, objects.\n\nmchange-commons-java v0.6.0 disables the `ReferenceIndirector` mechanism by default. This mechanism has been abused by attackers to inject dangerous JNDI `Reference` objects by causing an application to deserialize a malicious Java-serialized object. (The functionality remains for applications that need it, gated behind a restrictive configuration parameter. This is \"defense-in-depth\"; the hardening of `JavaBeanObjectFactory` on its own should be sufficient to prevent known `Reference`-based attacks. But perhaps there are other insecure `ObjectFactory` implementations on the `CLASSPATH` or vulnerabilities as-yet-unknown.)\n\n### Workarounds\nUpgrading to the current version of mchange-commons-java is strongly recommended. Most applications that install mchange-commons-java do so to support the c3p0 JDBC Connection pooling library. When upgrading mchange-commons-java, be sure to update c3p0 as well, or better yet, upgrade to c3p0 \u003e=v0.14.0 and bring in a patched mchange-commons-java transitively.\n\nMaintaining rigorous serialization filters can prevent many attacks (but not attacks requiring only construction of a named class and initialization of simple JavaBeans properties, as described for `JEditorPane` above).\n\nThe vulnerabilities that this advisory addresses all begin with arranging for an application to lookup a malicious JNDI `Reference` or deserialize a malicious Java-serialized object. Assiduously preventing an application from ever encountering such a `Reference` or serialized object is hypothetically a workaround. But relying upon perfection is usually bad planning.\n\nThe most common known attacks rely upon JVM-internal XSLT code that has been made inaccessible on Java 16 and beyond. Running on a more recent JVM is a mitigating workaround.\n\n### Resources\nThe vulnerabilities and security upgrades are documented in c3p0's manual. Please see c3p0's [Security Note](https://www.mchange.com/projects/c3p0/#security-note) and [Configuring Security](https://www.mchange.com/projects/c3p0/#configuring_security).\n\n### Credits\nmchange-commons-java thanks 4ra1n and unam4 on Github for a proof-of-concept.","status":"published","published":"2026-08-14T19:29:20Z","modified":"2026-08-14T19:29:21Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-55153","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","status":"published","published":"2026-07-01T21:17:03.823Z","modified":"2026-10-25T16:10:00.147Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-470","CWE-502"],"updated_at":"2026-11-02T14:12:27.199837Z"}],"osv":[{"id":"CVE-2026-55153","title":"mchange-commons-java contains elements susceptible to abuse via JNDI injection and \"deserialization gadgets\"","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","status":"published","published":"2026-07-01T20:02:47.254Z","modified":"2026-10-28T02:31:12.477783537Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470","CWE-502"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-h84g-69h7-mw6v","title":"mchange-commons-java contains elements susceptible to abuse via JNDI injection and \"deserialization gadgets\"","description":"### Impact\nPrior to version 0.6.0, mchange-commons-java includes a JNDI `ObjectFactory` implementation (`com.mchange.v2.naming.JavaBeanObjectFactory`) willing to construct objects of arbitrary classes and initialize \"JavaBean\"-style properties. There are classes for which this kind of initialization is unsafe. For example, setting the \"contentType\" property of a Swing `JEditorPane` to `text/html` and the \"text\" property to HTML containing a stylesheet \u0026lt;link\u0026gt; will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. This issue is aggravated by mchange-commons-java's `ReferenceIndirector`, by which malicious JNDI `Reference` objects could be smuggled in for dereferencing by applications anywhere a Java-serialized object might be read. \n\nPrior to version 0.5.0, the same mchange-commons-java `ObjectFactory` would interpret `BinaryRefAddress` elements as Java-serialized objects, and deserialize unexpected objects that potentially execute malicious behavior on initialization. Although this author is unaware of any code within mchange-commons-java itself that can be abused to execute code on deserialization, this mechanism can be used to trigger well-known \"deserialization gadget chains\" involving other libraries. For example, in JVMs prior to Java 16 with Apache libraries [`commons-beanutils`](https://commons.apache.org/proper/commons-beanutils/) and [`commons-collections`](https://commons.apache.org/proper/commons-collections/) on the application `CLASSPATH`, [objects can be crafted](https://gist.github.com/frohoff/9eb8811761ff989b3ac0) that will execute arbitrary commands on deserialization. (Thanks to Valerio Mulas for a proof-of-concept.)\n\n### Patches\nmchange-commons-java v0.5.0 eliminates all support for deserializing Java objects in `com.mchange.v2.naming.JavaBeanObjectFactory`, unless an application explicitly extends that class to restore it. This prevents mchange-commons-java from enabling JNDI injection to trigger common \"deserialization gadgets\".\n\nmchange-commons-java v0.6.0 imposes a whitelist upon what classes `com.mchange.v2.naming.JavaBeanObjectFactory` consents to materialize, preventing the use of maliciously constructed `Reference` instances to initialize arbitrary, potentially malicious, objects.\n\nmchange-commons-java v0.6.0 disables the `ReferenceIndirector` mechanism by default. This mechanism has been abused by attackers to inject dangerous JNDI `Reference` objects by causing an application to deserialize a malicious Java-serialized object. (The functionality remains for applications that need it, gated behind a restrictive configuration parameter. This is \"defense-in-depth\"; the hardening of `JavaBeanObjectFactory` on its own should be sufficient to prevent known `Reference`-based attacks. But perhaps there are other insecure `ObjectFactory` implementations on the `CLASSPATH` or vulnerabilities as-yet-unknown.)\n\n### Workarounds\nUpgrading to the current version of mchange-commons-java is strongly recommended. Most applications that install mchange-commons-java do so to support the c3p0 JDBC Connection pooling library. When upgrading mchange-commons-java, be sure to update c3p0 as well, or better yet, upgrade to c3p0 \u003e=v0.14.0 and bring in a patched mchange-commons-java transitively.\n\nMaintaining rigorous serialization filters can prevent many attacks (but not attacks requiring only construction of a named class and initialization of simple JavaBeans properties, as described for `JEditorPane` above).\n\nThe vulnerabilities that this advisory addresses all begin with arranging for an application to lookup a malicious JNDI `Reference` or deserialize a malicious Java-serialized object. Assiduously preventing an application from ever encountering such a `Reference` or serialized object is hypothetically a workaround. But relying upon perfection is usually bad planning.\n\nThe most common known attacks rely upon JVM-internal XSLT code that has been made inaccessible on Java 16 and beyond. Running on a more recent JVM is a mitigating workaround.\n\n### Resources\nThe vulnerabilities and security upgrades are documented in c3p0's manual. Please see c3p0's [Security Note](https://www.mchange.com/projects/c3p0/#security-note) and [Configuring Security](https://www.mchange.com/projects/c3p0/#configuring_security).\n\n### Credits\nmchange-commons-java thanks 4ra1n and unam4 on Github for a proof-of-concept.","status":"published","published":"2026-08-14T19:29:20Z","modified":"2026-09-10T03:51:14.278156192Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"UBUNTU-CVE-2026-55153","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","status":"published","published":"2026-07-01T21:17:00Z","modified":"2026-10-17T13:00:27.337616564Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1786542819","title":"TuxCare security update for com.mchange:mchange-commons-java (1 CVE)","description":"TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.20-tuxcare.2.","status":"published","published":"2026-08-12T13:53:39Z","modified":"2026-10-15T09:46:54.164035221Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786594683","title":"TuxCare security update for com.mchange:mchange-commons-java (1 CVE)","description":"TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.19-tuxcare.2.","status":"published","published":"2026-08-13T04:18:03Z","modified":"2026-10-15T09:46:53.801053947Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788238245","title":"TuxCare security update for com.mchange:mchange-commons-java (1 CVE)","description":"TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.15-tuxcare.2.","status":"published","published":"2026-09-01T04:50:45Z","modified":"2026-10-15T09:45:10.668315813Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"USN-8642-1","title":"c3p0 vulnerabilities","description":"It was discovered that c3p0 was vulnerable to remote code execution via maliciously\ncrafted serialized objects and JNDI references. An attacker could use this to\nexecute arbitrary code, bypass security restrictions, or cause a denial of service.","status":"published","published":"2026-08-18T13:02:22Z","modified":"2026-10-07T04:30:03.248967216Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}