Read the docs
TI-2026-22089 Aliases CVE-2026-27727GHSA-m2cm-222f-qw44

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Priority HIGH 74CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00977 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial mchange-commons-java (swaldman): 0.4.0com.mchange:mchange-commons-java (Maven): 0.4.0Red Hat: 10 advisoriesRed Hat: 11 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
swaldmanmchange-commons-javabefore 0.4.00.4.0Patch availableCNA
—com.mchange:mchange-commons-java (Maven)before 0.4.00.4.0Patch availableGHSA-m2cm-222f-qw44
  • mchange-commons-java Vendorswaldman Affected before 0.4.0 Fixed in 0.4.0 Patch available CNA
  • com.mchange:mchange-commons-java (Maven) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-m2cm-222f-qw44

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mchange:mchange_commons_java:*:*:*:*:*:*:*:*before 0.4.0VulnerableMchange
  • cpe:2.3:a:mchange:mchange_commons_java:*:*:*:*:*:*:*:* Versions before 0.4.0 Vulnerable ·Mchange

Remediation

  • Fix · CNA mchange-commons-java (swaldman) Fixed in 0.4.0
  • Fix · GHSA-m2cm-222f-qw44 com.mchange:mchange-commons-java (Maven) Fixed in 0.4.0 Advisory →

Red Hat 10 advisories

  • RHSA-2026:73976 Released 2026-09-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.16 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-hibernate-5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-hibernate-core-5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-hibernate-entitymanager-5.1.17-5.Final_redhat_00006.1.ep7.el7 +7
  • RHSA-2026:73644 Released 2026-09-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.19 Update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hibernate-5.3.39-1.Final_redhat_00001.1.el7eap, eap7-hibernate-core-5.3.39-1.Final_redhat_00001.1.el7eap, eap7-hibernate-entitymanager-5.3.39-1.Final_redhat_00001.1.el7eap +31
  • RHSA-2026:34365 Released 2026-07-01 · Red Hat rating Important
    Satellite 6.19.2 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 candlepin-4.7.5-1.el9sat, candlepin-selinux-4.7.5-1.el9sat, foreman-3.18.0.7-1.el9sat +17
Show 7 more Red Hat advisories
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
  • RHSA-2026:14874 Released 2026-05-07 · Red Hat rating Important
    Satellite 6.16.8 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 candlepin-4.4.25-1.el8sat, candlepin-selinux-4.4.25-1.el8sat, python-markdown-3.8.2-1.el8pc +6
    • Red Hat Satellite 6.16 for RHEL 9 candlepin-4.4.25-1.el9sat, candlepin-selinux-4.4.25-1.el9sat, python-markdown-3.8.2-1.el9pc +6
  • RHSA-2026:14873 Released 2026-05-07 · Red Hat rating Important
    Satellite 6.17.8 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 candlepin-4.4.25-1.el9sat, candlepin-selinux-4.4.25-1.el9sat, python-markdown-3.8.2-1.el9pc +6
  • RHSA-2026:4285 Released 2026-03-11 · Red Hat rating Important
    Red Hat build of Debezium 3.2.7 release
    • Red Hat Build of Debezium 3.2
  • RHSA-2026:3890 Released 2026-03-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix yet
streams for Apache Kafka 2AffectedNo fix planned: Will not fix
Red Hat Build of Debezium 3.2Fixed RHSA-2026:4285
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:18055
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2026:73976
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:73644
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:14874
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:14874
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:14873
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:34365
Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11Fixed RHSA-2026:3890
Not affected: 10 products
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss EAP 8.1 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • Red Hat build of Apache Camel - HawtIO 4
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27727
  2. 2026-10-03 Alias added: GHSA-m2cm-222f-qw44
  3. 2026-10-09 Fix available: RHSA-2026:4285 · Red Hat
  4. 2026-10-10 Fix available: Red Hat Build of Debezium 3.2 · Red Hat
  5. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  6. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-22181 c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property CVSS 4.0HIGH 8.9
  • TI-2026-39900 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties CVSS 4.0MEDIUM 6.3
  • TI-2026-39844 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets" CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences