Listen to this Post
The vulnerability resides in mchange-commons-java, a utility library often used with the c3p0 connection pool. The library contains an independent implementation of Java Naming and Directory Interface (JNDI) functionality, which mirrors early, less secure JDK versions. This implementation includes support for a remote `factoryClassLocation` attribute within `javax.naming.Reference` objects. When an application resolves such a reference, the library’s `com.mchange.v2.naming.ReferenceableUtils.referenceToObject` method can download and instantiate a class from the specified remote URL. Critically, this behavior is not governed by the JDK’s security property com.sun.jndi.ldap.object.trustURLCodebase, which defaults to `false` and was introduced to prevent exactly this type of attack in the standard JNDI implementation. Therefore, even if the JDK is fully patched, an application using a vulnerable version of mchange-commons-java remains exposed. An attacker can trigger this by supplying a maliciously crafted `Reference` object or serialized data to the application, often through deserialization vulnerabilities in other components or by controlling a JNDI lookup source. Once the malicious class is downloaded and instantiated, it executes with the privileges of the Java application, leading to full remote code execution. The issue is fixed in version 0.4.0, where the JNDI resolution process is now gated by restrictive configuration parameters that disable remote code loading by default. There are no known workarounds for versions prior to 0.4.0, making an upgrade the only safe mitigation.
dailycve form:
Platform: mchange-commons-java
Version: < 0.4.0
Vulnerability: JNDI Remote Code Execution
Severity: Critical
Date: 02/25/2026
Prediction: Patch available in 0.4.0
What Undercode Say:
Analytics:
To determine if your project is affected, check your Maven dependencies:
mvn dependency:tree | grep -i "mchange-commons-java"
For Gradle projects:
gradle dependencies | grep -i "mchange-commons-java"
If an older version is found, update your build configuration. For Maven, set the version to 0.4.0 or higher:
<dependency> <groupId>com.mchange</groupId> <artifactId>mchange-commons-java</artifactId> <version>0.4.0</version> </dependency>
For applications that cannot upgrade immediately, as a defense-in-depth measure, you can attempt to globally disable the loading of remote factories by setting the following system property, though this is not a guaranteed mitigation as the library’s implementation may ignore it:
java -Dcom.mchange.v2.naming.ReferenceableUtils.disableRemoteFactory=true -jar yourapp.jar
Review your application’s code for any places where JNDI lookups are performed with user-controlled input or where untrusted serialized data is deserialized.
Exploit:
An attacker crafts a malicious JNDI Reference object pointing to a remote class. For example, the Reference can be created with a factory class name and a remote `factoryClassLocation` (e.g., `http://attacker.com/Evil.class`). The attacker then delivers this object to the target application, often via a deserialization gadget chain (such as those in common libraries like CommonsCollections) or by poisoning a JNDI lookup source (e.g., an LDAP server). When the vulnerable mchange-commons-java code processes this reference, it fetches and executes the `Evil.class` from the attacker’s server, leading to RCE.
Protection from this CVE
Upgrade to mchange-commons-java version 0.4.0 or later. This version introduces security parameters that default to blocking remote code loading. If you are a maintainer of a library that depends on mchange-commons-java (such as c3p0), ensure you are bundling or requiring the patched version. For applications, perform a full rebuild and redeploy with the updated library. There is no other reliable workaround.
Impact:
Successful exploitation leads to remote code execution in the context of the Java application. This can result in complete system compromise, data theft, installation of backdoors, or further lateral movement within a network. Given the widespread use of mchange-commons-java and c3p0 in enterprise Java applications, this vulnerability poses a critical risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
