CVE-2026-55153: mchange-commons-java JNDI Injection and Deserialization Vulnerability
Summary
CVE-2026-55153: Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) willing to construct objects of arbitrary classes and initialize "JavaBean"-s... Affects com.mchange:mchange-commons-java versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mchange-commons-java is a library designed for managing Java objects and providing utilities for JDBC connection pooling, particularly with the c3p0 library. It allows for the construction and initialization of JavaBeans, but prior to version 0.6.0, it contained a JNDI ObjectFactory that could be exploited to create unsafe object instances, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the JNDI ObjectFactory implementation in mchange-commons-java, which allows for the construction of arbitrary classes and initialization of their properties. This can lead to JNDI injection attacks, where malicious JNDI Reference objects can be introduced, potentially triggering HTTP requests to arbitrary URLs from trusted domains. Additionally, the library's handling of Java serialization can be exploited to execute malicious code through deserialization gadgets, especially when combined with other libraries like Apache commons-beanutils and commons-collections.
How To Fix
Latest published version: 0.6.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rigorous serialization filters to mitigate risks. However, be aware that this may not prevent all forms of attack, particularly those involving the initialization of JavaBeans properties. Running on a more recent JVM version may also help reduce exposure to known attacks.
Conclusion
The mchange-commons-java library has a significant vulnerability related to JNDI injection and deserialization, which can lead to severe security risks. Upgrading to version 0.6.0 or later is crucial to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for com.mchange:mchange-commons-java →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Exploitation of this vulnerability can lead to unauthorized HTTP requests, remote code execution, and compromise of application security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can be exploited using libraries such as Apache commons-beanutils and commons-collections, which can trigger deserialization gadget chains.
Upgrading to the latest version of mchange-commons-java and maintaining strict serialization filters can help prevent JNDI injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.mchange:mchange-commons-java.
