Read the docs
TI-2026-39844 Aliases CVE-2026-55153GHSA-h84g-69h7-mw6v

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Priority LOW 33CWE-470Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Partial mchange-commons-java (swaldman): 0.6.0com.mchange:mchange-commons-java (Maven): 0.6.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
swaldmanmchange-commons-javabefore 0.6.00.6.0Patch availableCNA
—com.mchange:mchange-commons-java (Maven)before 0.6.00.6.0Patch availableGHSA-h84g-69h7-mw6v
  • mchange-commons-java Vendorswaldman Affected before 0.6.0 Fixed in 0.6.0 Patch available CNA
  • com.mchange:mchange-commons-java (Maven) Vendor— Affected before 0.6.0 Fixed in 0.6.0 Patch available GHSA-h84g-69h7-mw6v

Remediation

  • Fix · CNA mchange-commons-java (swaldman) Fixed in 0.6.0
  • Fix · GHSA-h84g-69h7-mw6v com.mchange:mchange-commons-java (Maven) Fixed in 0.6.0 Advisory →

Red Hat 1 advisory

  • RHSA-2026:54622 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16Fixed RHSA-2026:54622
Not affected: 4 products
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6
  • Red Hat build of Debezium 3
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55153
  2. 2026-10-03 Alias added: GHSA-h84g-69h7-mw6v
  3. 2026-11-03 Affected versions changed · Red Hat

References

Advisory 1

Other 2

  • TI-2026-22181 c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property CVSS 4.0HIGH 8.9
  • TI-2026-39900 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences