mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Vulnerability

Overview

CVE-2026-27727 is a critical vulnerability in mchange-commons-java, a utility library used by the c3p0 connection pool. The library includes an independent implementation of JNDI functionality that supports remote factoryClassLocation values, allowing code to be downloaded and executed. This mirrors early JDK implementations of JNDI implementations had similar issues, but were mitigated by the com.sun.jndi.ldap.object.trustURLCodebase property defaulting to false. However, mchange-commons-java's separate implementation was not subject to this JDK hardening, meaning applications using c3p0 could still be exploited via crafted javax.naming.Reference objects or serialized data [1][4].

Exploitation

An attacker who can cause an application to deserialize a malicious javax.naming.Reference or a serialized object can trigger the download and execution of arbitrary code. This is possible because mchange-commons-java's JNDI resolution does not respect the JDK's trustURLCodebase setting. The c3p0 library, which depends on mchange-commons-java, has been used as a deserialization gadget chain for about a decade, as noted in the project's own documentation [1][2]. The gadget chain is well-documented and can be used in tools like ysoserial, and exploitation remains possible on modern Java versions because the functionality is independent of the JDK [3].

Impact

Successful exploitation allows an attacker to achieve remote code execution (RCE) within the context of the vulnerable application. This can lead to full compromise of the application server, data theft, or further lateral movement within the network. The vulnerability is particularly dangerous because c3p0 is a transitive dependency of many widely used libraries, meaning it may be present on the classpath even if not directly used [3].

Mitigation

The vulnerability is fixed in mchange-commons-java version 0.4.0, which gates the dangerous JNDI functionality behind configuration parameters that default to restrictive values. The c3p0 library version 0.12.0 includes this fix, and version 0.13.0 (with mchange-commons-java 0.5.0) eliminates all use of Java serialization in resolving References, definitively closing the attack vector [1][2]. Users should upgrade to c3p0 0.12.0 or later (or mchange-commons-java 0.4.0 or later). No workarounds are available for earlier versions [4].