Junglewise Threat Intelligence

CVE-2026-27727: mchange-commons-java remote code execution via JNDI dereferencing

CVE-2026-27727 · Severity: critical · CVSS 9.8 · Published 2026-02-25

Technologies: Mchange C3p0. Vendors: Maven, Red Hat, Mchange.

Executive brief

mchange-commons-java is a utility library often used by database connection tools like c3p0 to manage how applications talk to databases. A security flaw in this library allows an attacker to force an application to download and run malicious code from a remote server. This can lead to a full system takeover, even if the underlying Java environment has been updated with modern security protections. Organizations should update the library to version 0.4.0 or higher to block this unauthorized remote code execution.

Technical details

The mchange-commons-java library includes a custom implementation of JNDI dereferencing that mirrors early, insecure JDK behavior. Specifically, it supports remote 'factoryClassLocation' values in 'javax.naming.Reference' objects, which enables the downloading and execution of remote bytecode. Unlike the standard JDK JNDI implementation, which disables this behavior by default via the 'com.sun.jndi.ldap.object.trustURLCodebase' property, the mchange-commons-java implementation remained active. An attacker can exploit this by providing a maliciously crafted serialized object or JNDI reference to an application using this library (or dependent libraries like c3p0). This results in unauthenticated remote code execution (RCE). The vulnerability is fixed in version 0.4.0, which introduces restrictive configuration defaults for JNDI functionality.

Affected products

  • mchange mchange-commons-java prior to 0.4.0
  • mchange c3p0 all versions using mchange-commons-java < 0.4.0
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat Satellite 6.16, 6.17

Timeline

  • 2025-02-23: advisory: GitHub Advisory GHSA-m2cm-222f-qw44 published
  • 2026-02-25: disclosed: CVE-2026-27727 published to NVD
  • 2026-02-25: patched: Version 0.4.0 released with restrictive defaults

References

Related threats