CVE-2026-55153
Impact
Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is unsafe. For example, setting the "contentType" property of a Swing JEditorPane to text/html and the "text" property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. This issue is aggravated by mchange-commons-java's ReferenceIndirector, by which malicious JNDI Reference objects could be smuggled in for dereferencing by applications anywhere a Java-serialized object might be read.
Prior to version 0.5.0, the same mchange-commons-java ObjectFactory would interpret BinaryRefAddress elements as Java-serialized objects, and deserialize unexpected objects that potentially execute malicious behavior on initialization. Although this author is unaware of any code within mchange-commons-java itself that can be abused to execute code on deserialization, this mechanism can be used to trigger well-known "deserialization gadget chains" involving other libraries. For example, in JVMs prior to Java 16 with Apache libraries commons-beanutils and commons-collections on the application CLASSPATH, objects can be crafted that will execute arbitrary commands on deserialization. (Thanks to Valerio Mulas for a proof-of-concept.)
Patches
mchange-commons-java v0.5.0 eliminates all support for deserializing Java objects in com.mchange.v2.naming.JavaBeanObjectFactory, unless an application explicitly extends that class to restore it. This prevents mchange-commons-java from enabling JNDI injection to trigger common "deserialization gadgets".
mchange-commons-java v0.6.0 imposes a whitelist upon what classes com.mchange.v2.naming.JavaBeanObjectFactory consents to materialize, preventing the use of maliciously co
CSIRTS triage
- What
- c3p0 is vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references.
- Who is affected
- Applications using c3p0 connection pooling library that deserialize untrusted data.
- Urgency
- Critical; remote code execution is exploitable without authentication and can bypass security restrictions or cause denial of service.
- Action
- Update c3p0 to a patched version addressing CVE-2026-55223, CVE-2026-55153, CVE-2026-27830, and CVE-2026-27727.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-55153
Get an email if CVE-2026-55153 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Advisory coverage (3)
- unknownUSN-8642-1: c3p0 vulnerabilitiesubuntu · 2026-08-18
- highGHSA-h84g-69h7-mw6v: mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deser…ghsa · 2026-08-14
- highCVE-2026-55153: mchange-commons-java is a Java library of shared utility classes used by mchange projects like…nvd · 2026-07-01
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-55153)