{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/mchange/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-55153"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mchange-commons-java (\u003c 0.6.0)","c3p0 (\u003c 0.14.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["mchange"],"content_html":"\u003cp\u003eThe mchange-commons-java library, commonly used as a dependency for the c3p0 JDBC connection pool, contained multiple vulnerabilities in its \u003ccode\u003ecom.mchange.v2.naming.JavaBeanObjectFactory\u003c/code\u003e class and \u003ccode\u003eReferenceIndirector\u003c/code\u003e mechanism. Versions prior to 0.5.0 allowed \u003ccode\u003eBinaryRefAddress\u003c/code\u003e elements to be interpreted as Java-serialized objects, enabling the execution of arbitrary code via deserialization gadget chains if libraries like \u003ccode\u003ecommons-collections\u003c/code\u003e are present on the classpath.\u003c/p\u003e\n\u003cp\u003eFurthermore, versions prior to 0.6.0 permitted the \u003ccode\u003eJavaBeanObjectFactory\u003c/code\u003e to instantiate arbitrary classes and set properties. Attackers could leverage this via JNDI injection to perform actions such as SSRF (e.g., triggering HTTP requests via \u003ccode\u003eJEditorPane\u003c/code\u003e) or remote code execution. The \u003ccode\u003eReferenceIndirector\u003c/code\u003e mechanism further facilitated these attacks by allowing malicious JNDI \u003ccode\u003eReference\u003c/code\u003e objects to be smuggled through serialized data. These issues were addressed in version 0.6.0 by imposing class whitelisting, disabling deserialization support in the \u003ccode\u003eObjectFactory\u003c/code\u003e by default, and disabling the \u003ccode\u003eReferenceIndirector\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability impacts any Java application utilizing mchange-commons-java versions below 0.6.0, particularly those using the c3p0 connection pool. If exploited, an attacker could achieve remote code execution on the application server or perform server-side request forgery (SSRF). The success of deserialization-based RCE depends on the presence of vulnerable gadget chains within the application's classpath, while JNDI injection-based SSRF can affect environments regardless of secondary gadget availability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003emchange-commons-java\u003c/code\u003e to version 0.6.0 or higher.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003ec3p0\u003c/code\u003e to version 0.14.0 or higher, which includes the patched \u003ccode\u003emchange-commons-java\u003c/code\u003e library transitively.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement rigorous Java serialization filters (JEP 290/394) to block the deserialization of untrusted classes.\u003c/li\u003e\n\u003cli\u003eMigrate to JVM version 16 or newer, as this makes internal JVM-based XSLT gadget chains inaccessible.\u003c/li\u003e\n\u003cli\u003eAudit application classpaths to identify and remove unnecessary libraries containing known deserialization gadgets (e.g., \u003ccode\u003ecommons-beanutils\u003c/code\u003e, \u003ccode\u003ecommons-collections\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-14T20:06:44Z","date_published":"2026-08-14T20:06:44Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mchange-commons-java-vulnerabilities/","summary":"mchange-commons-java versions prior to 0.6.0 are susceptible to JNDI injection and deserialization gadget attacks due to insecure ObjectFactory implementations and the ReferenceIndirector mechanism.","title":"Multiple Vulnerabilities in mchange-commons-java","url":"https://feed.craftedsignal.io/briefs/2026-08-mchange-commons-java-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Mchange","version":"https://jsonfeed.org/version/1.1"}