CVE-2026-55153 Details
Description
mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.
A vulnerability in mchange-commons-java prior to version 0.6.0 allows for JNDI injection and the use of 'deserialization gadgets'. The issue arises from the JNDI ObjectFactory implementation, which can construct objects of arbitrary classes and initialize 'JavaBean'-style properties. This behavior is unsafe for certain classes, such as Swing's JEditorPane, where specific property settings can trigger HTTP requests to arbitrary URLs, potentially within a trusted security domain. The vulnerability is exacerbated by the library's ReferenceIndirector, which can be used to inject malicious JNDI Reference objects for dereferencing by applications that read Java-serialized objects.
Upgrading to mchange-commons-java version 0.6.0 or later is recommended. Most applications using mchange-commons-java do so for c3p0 JDBC connection pooling, so it is advisable to update c3p0 as well. Maintaining strict serialization filters can also help prevent such attacks. For applications on Java 16 or later, the common known attacks associated with this vulnerability are mitigated.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-h84g-69h7-mw6v | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |