Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M
CVE-2026-27727mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
High 8.3
In plain English
A high-severity injection in mchange-commons-java from swaldman. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.mchange:mchange-commons-java | 0.4.0 | GHSA-m2cm-222f-qw44 |
| Ubuntu:25.10 | c3p0 | no fix listed | UBUNTU-CVE-2026-27727 |
| Ubuntu:26.10 | c3p0 | no fix listed | UBUNTU-CVE-2026-27727 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| swaldman | mchange-commons-java | < 0.4.0 |
Weakness: CWE-74, CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44 x_refsource_CONFIRM
- https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal x_refsource_MISC
- https://www.mchange.com/projects/c3p0/#configuring_security x_refsource_MISC
- https://www.mchange.com/projects/c3p0/#security-note x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-27727 vdb-entry, x_refsource_REDHAT
- RHBZ#2442671 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27727.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:18054 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14874 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18055 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14873 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34365 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4285 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18059 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3890 vendor-advisory, x_refsource_REDHAT