CVE-2026-55153: swaldman mchange-commons-java JNDI injection and unsafe deserialization

CVE-2026-55153 · Severity: high · CVSS 7.1 · Published 2026-07-01

mchange-commons-java is a Java utility library commonly used by the c3p0 JDBC connection pooling library. Prior to version 0.6.0, the library's JNDI ObjectFactory component can be exploited to instantiate arbitrary classes and initialize their properties in unsafe ways. An attacker can use this flaw to trigger arbitrary code execution via JNDI injection attacks or by chaining with deserialization gadgets from other libraries (such as Apache commons-beanutils or commons-collections), potentially compromising the integrity and availability of applications using this library.

Vendors: Maven, Mchange.

Quick answers

Is CVE-2026-55153 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55153 being exploited in the wild.
How severe is CVE-2026-55153?
High severity, with a CVSS score of 7.1, published 1 July 2026.
Which products and versions are affected?
com.mchange:mchange-commons-java (Maven) < 0.6.0, ECOSYSTEM:introduced=0,fixed=0.6.0; Mchange Commons Java < 0.6.0.
Is there a fix for CVE-2026-55153?
Yes. com.mchange:mchange-commons-java (Maven): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55153 attacked?
It is attacked from the adjacent network or over the network, in a software library.
Am I affected by CVE-2026-55153?
Check whether you run com.mchange:mchange-commons-java (Maven) or Mchange Commons Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.mchange:mchange-commons-java (Maven): upgrade to 0.6.0 or later
    # set com.mchange:mchange-commons-java to 0.6.0 in your pom.xml or build.gradle

Technical details

The vulnerability involves two related unsafe mechanisms in mchange-commons-java's com.mchange.v2.naming.JavaBeanObjectFactory class. Prior to v0.5.0, the factory would deserialize BinaryRefAddress elements as arbitrary Java objects, enabling attackers to trigger deserialization gadget chains from libraries like commons-beanutils and commons-collections to achieve remote code execution. Prior to v0.6.0, the factory constructs arbitrary classes via JNDI Reference objects and initializes JavaBean properties without adequate validation. For example, an attacker can set JEditorPane properties to cause HTTP requests to attacker-controlled URLs. Additionally, the ReferenceIndirector mechanism allows injection of malicious JNDI References through deserialized objects. The vulnerabilities require an attacker to arrange for the application to lookup a malicious JNDI Reference or deserialize a hostile serialized object. Patches v0.5.0 eliminates Java object deserialization, and v0.6.0 imposes a whitelist on allowable classes and disables ReferenceIndirector by default.

Affected products

  • mchange mchange-commons-java < 0.6.0

Identifiers

  • CVE-2026-55153
  • GHSA-h84g-69h7-mw6v

Timeline

  • 2026-06-10: disclosed: Published by GitHub Advisory Database
  • 2026-07-01: advisory: Published by National Vulnerability Database
  • 2026-06-10: patched: Version 0.6.0 released with hardening and whitelist; v0.5.0 eliminated deserialization support

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.