Mchange

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Mchange records in CISA KEV

No Mchange vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

C3p0 2 records MEDIUM Mchange Commons Java 1 record HIGH

Records

3 records

TI-2026-22089 CVE-2026-27727 · GHSA-m2cm-222f-qw44

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

HIGH 74

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downl…

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00977 Published 2026-02-25 Partial fix · 0.4.0 CWE-74

TI-2018-14478 CVE-2018-20433 · GHSA-q485-j897-qc27

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in…

MEDIUM 49

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04589 Published 2018-12-24 Partial fix · 0.9.5.3 CWE-611

TI-2019-03837 CVE-2019-5427 · GHSA-84p2-vf58-xhxv

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML…

MEDIUM 41

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04882 Published 2019-04-22 Partial fix · 0.9.5.4 CWE-776

Open these records in search →

Critical	1
High	2
Medium	0
Low	0
No CVSS	0