CVE-2026-27727: mchange-commons-java remote code execution via JNDI dereferencing

CVE-2026-27727 · Severity: critical · CVSS 9.8 · Published 2026-02-25

mchange-commons-java is a utility library often used by database connection tools like c3p0 to manage how applications talk to databases. A security flaw in this library allows an attacker to force an application to download and run malicious code from a remote server. This can lead to a full system takeover, even if the underlying Java environment has been updated with modern security protections. Organizations should update the library to version 0.4.0 or higher to block this unauthorized remote code execution.

Technologies: Mchange C3p0. Vendors: Maven, Mchange.

Quick answers

Is CVE-2026-27727 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27727 being exploited in the wild.
How severe is CVE-2026-27727?
Critical severity, with a CVSS score of 9.8, published 25 February 2026.
Which products and versions are affected?
com.mchange:mchange-commons-java (Maven) ECOSYSTEM:introduced=0,fixed=0.4.0; Mchange C3p0 all versions using mchange-commons-java < 0.4.0; Mchange Commons Java prior to 0.4.0.
Is there a fix for CVE-2026-27727?
Yes. com.mchange:mchange-commons-java (Maven): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27727 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27727?
Check whether you run com.mchange:mchange-commons-java (Maven), Mchange C3p0 or Mchange Commons Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.mchange:mchange-commons-java (Maven): upgrade to 0.4.0 or later
    # set com.mchange:mchange-commons-java to 0.4.0 in your pom.xml or build.gradle

Technical details

The mchange-commons-java library includes a custom implementation of JNDI dereferencing that mirrors early, insecure JDK behavior. Specifically, it supports remote 'factoryClassLocation' values in 'javax.naming.Reference' objects, which enables the downloading and execution of remote bytecode. Unlike the standard JDK JNDI implementation, which disables this behavior by default via the 'com.sun.jndi.ldap.object.trustURLCodebase' property, the mchange-commons-java implementation remained active. An attacker can exploit this by providing a maliciously crafted serialized object or JNDI reference to an application using this library (or dependent libraries like c3p0). This results in unauthenticated remote code execution (RCE). The vulnerability is fixed in version 0.4.0, which introduces restrictive configuration defaults for JNDI functionality.

Affected products

  • mchange mchange-commons-java prior to 0.4.0
  • mchange c3p0 all versions using mchange-commons-java < 0.4.0
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat Satellite 6.16, 6.17

Identifiers

  • CVE-2026-27727
  • GHSA-m2cm-222f-qw44

Timeline

  • 2025-02-23: advisory: GitHub Advisory GHSA-m2cm-222f-qw44 published
  • 2026-02-25: disclosed: CVE-2026-27727 published to NVD
  • 2026-02-25: patched: Version 0.4.0 released with restrictive defaults

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.