Vulnerabilities

TI-2026-22089 CVE-2026-27727 · GHSA-m2cm-222f-qw44

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

HIGH 74

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downl…

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00977 Published 2026-02-25 Partial fix · 0.4.0 CWE-74

TI-2019-03837 CVE-2019-5427 · GHSA-84p2-vf58-xhxv

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML…

MEDIUM 41

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04882 Published 2019-04-22 Partial fix · 0.9.5.4 CWE-776

TI-2018-14478 CVE-2018-20433 · GHSA-q485-j897-qc27

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in…

MEDIUM 49

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04589 Published 2018-12-24 Partial fix · 0.9.5.3 CWE-611

Vulnerabilities

Filters

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML…

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in…