Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
swaldman mchange-commons-java — mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P H N H H H 8.9 .0081 54.2 —
AFFECTED
Product Versions Fixed
mchange-commons-java < 0.4.0 – —
TIMELINE
Feb 23 Reserved by GitHub_M
Feb 25 Published (CNA: GitHub_M)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-27727 (swaldman mchange-commons-java). Public exploit reference added.
Description
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| February 23, 2026 | Reserved | Reserved by GitHub_M |
| February 25, 2026 | Published | Published (CNA: GitHub_M) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-27727 (swaldman mchange-commons-java). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| swaldman | mchange-commons-java | — | < 0.4.0 | — |
References (15)
- https://access.redhat.com/errata/RHSA-2026:14873 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:14874 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:18054 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:18055 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:18059 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:34365 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:3890 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:4285 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/security/cve/CVE-2026-27727 [vdb-entry, x_refsource_REDHAT]
- https://bugzilla.redhat.com/show_bug.cgi?id=2442671 [issue-tracking, x_refsource_REDHAT]
- https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44 [x_refsource_CONFIRM]
- https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal [x_refsource_MISC]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27727.json [x_sadp-csaf-vex]
- https://www.mchange.com/projects/c3p0/#configuring_security [x_refsource_MISC]
- https://www.mchange.com/projects/c3p0/#security-note [x_refsource_MISC]
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-27727 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.