Executive brief
mchange-commons-java is a Java utility library commonly used by the c3p0 JDBC connection pooling library. Prior to version 0.6.0, the library's JNDI ObjectFactory component can be exploited to instantiate arbitrary classes and initialize their properties in unsafe ways. An attacker can use this flaw to trigger arbitrary code execution via JNDI injection attacks or by chaining with deserialization gadgets from other libraries (such as Apache commons-beanutils or commons-collections), potentially compromising the integrity and availability of applications using this library.
Technical details
The vulnerability involves two related unsafe mechanisms in mchange-commons-java's com.mchange.v2.naming.JavaBeanObjectFactory class. Prior to v0.5.0, the factory would deserialize BinaryRefAddress elements as arbitrary Java objects, enabling attackers to trigger deserialization gadget chains from libraries like commons-beanutils and commons-collections to achieve remote code execution. Prior to v0.6.0, the factory constructs arbitrary classes via JNDI Reference objects and initializes JavaBean properties without adequate validation. For example, an attacker can set JEditorPane properties to cause HTTP requests to attacker-controlled URLs. Additionally, the ReferenceIndirector mechanism allows injection of malicious JNDI References through deserialized objects. The vulnerabilities require an attacker to arrange for the application to lookup a malicious JNDI Reference or deserialize a hostile serialized object. Patches v0.5.0 eliminates Java object deserialization, and v0.6.0 imposes a whitelist on allowable classes and disables ReferenceIndirector by default.
Affected products
- mchange mchange-commons-java < 0.6.0
Timeline
- 2026-06-10: disclosed: Published by GitHub Advisory Database
- 2026-07-01: advisory: Published by National Vulnerability Database
- 2026-06-10: patched: Version 0.6.0 released with hardening and whitelist; v0.5.0 eliminated deserialization support