PT-2026-21943 · Unknown+1 · Mchange-Commons-Java+1

Dpp · Published 2026-02-25 · Updated 2026-05-01 · CVE-2026-27727

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mchange-commons-java versions prior to 0.4.0

Description mchange-commons-java, a library providing Java utilities, contains code that replicates early JNDI implementations, including support for remote factoryClassLocation values. This allows for the potential download and execution of malicious code if an application processes a specially crafted jaxax.naming.Reference or serialized object. While the JDK has default protections against this behavior via the com.sun.jndi.ldap.object.trustURLCodebase System property, mchange-commons-java's independent JNDI implementation bypasses these protections. This means that libraries like c3p0, which use mchange-commons-java for JNDI resolution, could be exploited even with a hardened JDK. The library's JNDI functionality is now protected by configuration parameters that default to restrictive values, starting with version 0.4.0. The API endpoint is not explicitly mentioned. The vulnerable parameter is factoryClassLocation.

Recommendations Upgrade to mchange-commons-java version 0.4.0 or later. Avoid using versions of mchange-commons-java prior to 0.4.0 on application CLASSPATHs.

Exploit

Fix

RCE

Special Elements Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-74

CWE-502

Related Identifiers

CVE-2026-27727

GHSA-M2CM-222F-QW44

OESA-2026-1690

OPENSUSE-SU-2026:10279-1

OPENSUSE-SU-2026:10281-1

RHSA-2026:14873

RHSA-2026:14874

SUSE-SU-2026:0855-1

SUSE-SU-2026:1035-1

Affected Products

C3P0

Mchange-Commons-Java

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27727.json · Exploit
• 🔥 https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal · Exploit
• https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10279-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1690 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2cm-222f-qw44 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10281-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0855-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27727 · Security Note
• https://github.com/swaldman/mchange-commons-java · Note
• https://bugzilla.suse.com/1258942 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1690 · Note
• https://suse.com/security/cve/CVE-2026-27727 · Note
• https://bugzilla.suse.com/1259313 · Note