CVE catalog
CVE-2026-27727
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by whi
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.98% · Oct 25, 2026
A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted `javax.naming.Reference` or serialized object to an application using the library. This can provoke the application to download and execute arbitrary malicious code due to mchange-commons-java's independent implementation of Java Naming and Directory Interface (JNDI) dereferencing, which supports remote code loading. This could lead to arbitrary code execution within the affected application. com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Maven | com.mchange:mchange-commons-java | Not reported | 0.4.0 | fixed |
| Cpe | mchange_commons_java | Not reported | 0.4.0 | fixed |
| Ubuntu | c3p0 | noble | 0.9.1.2-10ubuntu2+esm1 | fixed |
| Ubuntu | libc3p0-java | noble | 0.9.1.2-10ubuntu2+esm1 | fixed |
| Ubuntu | libc3p0-java-doc | noble | 0.9.1.2-10ubuntu2+esm1 | fixed |
| Ubuntu | c3p0 | pro | 0.9.1.2-10ubuntu2 | vulnerable |
| Ubuntu | c3p0 | pro | 0.9.1.2-11 | vulnerable |
| Ubuntu | c3p0 | pro | 0.9.1.2-11ubuntu0.1~esm1 | fixed |
| Opensuse | mchange-commons | tumbleweed | 0.4.0-1.1 | fixed |
| Opensuse | c3p0 | tumbleweed | 0.12.0-1.1 | fixed |
| Opensuse | c3p0 | leap 15.6 | 0.9.5.5-150400.3.5.1 | fixed |
| Opensuse | mchange-commons | leap 15.6 | 0.2.20-150400.3.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Maven | com.mchange:mchange-commons-java | maven | Not reported | 0.4.0 | Not reported | Not reported | Not reported |
| Cpe | mchange_commons_java | cpe | Not reported | 0.4.0 | Not reported | NVD-CVE-2026-27727 | Not reported |
| Ubuntu | c3p0 | deb | noble | 0.9.1.2-10ubuntu2+esm1 | Not reported | Not reported | Not reported |
| Ubuntu | libc3p0-java | deb | noble | 0.9.1.2-10ubuntu2+esm1 | Not reported | Not reported | Not reported |
| Ubuntu | libc3p0-java-doc | deb | noble | 0.9.1.2-10ubuntu2+esm1 | Not reported | Not reported | Not reported |
| Ubuntu | c3p0 | deb | pro | 0.9.1.2-11ubuntu0.1~esm1 | Not reported | USN-8642-1 | Not reported |
| Opensuse | mchange-commons | rpm | tumbleweed | 0.4.0-1.1 | Not reported | OPENSUSE-SU-2026:10281-1 | Not reported |
| Opensuse | c3p0 | rpm | tumbleweed | 0.12.0-1.1 | Not reported | OPENSUSE-SU-2026:10279-1 | Not reported |
| Opensuse | c3p0 | rpm | leap 15.6 | 0.9.5.5-150400.3.5.1 | Not reported | SUSE-SU-2026:0855-1 | Not reported |
| Opensuse | mchange-commons | rpm | leap 15.6 | 0.2.20-150400.3.3.1 | Not reported | SUSE-SU-2026:0855-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [c3p0-javadoc]Unknown
Source package: [c3p0]
Details (1)
0.14.1-1.3· noarch · tumbleweedUnknown · Fixed:
0.12.0-1.1Version impact unknown
nvd · c3p0 · opensuse · tumbleweed
- [mchange-commons-javadoc]Unknown
Source package: [mchange-commons]
Details (1)
0.6.1-1.3· noarch · tumbleweedUnknown · Fixed:
0.4.0-1.1Version impact unknown
nvd · mchange-commons · opensuse · tumbleweed
- [c3p0]Fixed
Source package: [c3p0]
Details (1)
0.14.1-1.3· noarch · tumbleweedFixed · Fixed:
0.12.0-1.1nvd · c3p0 · opensuse · tumbleweed
- [mchange-commons]Fixed
Source package: [mchange-commons]
Details (1)
0.6.1-1.3· noarch · tumbleweedFixed · Fixed:
0.4.0-1.1nvd · mchange-commons · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10279-1.json]
- [https://github.com/advisories/GHSA-m2cm-222f-qw44]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27727]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0855-1]
- [https://osv.dev/vulnerability/USN-8642-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10279-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10281-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27727.json]
- [https://ubuntu.com/security/notices/USN-8642-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1608.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]