CVE-2026-27727

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.

• CWE-74
• CWE-502

• https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44Patch, Vendor Advisory
• https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascalExploit, Third Party Advisory
• https://www.mchange.com/projects/c3p0/#configuring_securityIssue Tracking
• https://www.mchange.com/projects/c3p0/#security-noteRelease Notes
• https://access.redhat.com/errata/RHSA-2026:14873
• https://access.redhat.com/errata/RHSA-2026:14874
• https://access.redhat.com/errata/RHSA-2026:18054
• https://access.redhat.com/errata/RHSA-2026:18055
• https://access.redhat.com/errata/RHSA-2026:18059
• https://access.redhat.com/errata/RHSA-2026:34365
• https://access.redhat.com/errata/RHSA-2026:3890
• https://access.redhat.com/errata/RHSA-2026:4285
• https://access.redhat.com/security/cve/CVE-2026-27727
• https://bugzilla.redhat.com/show_bug.cgi?id=2442671
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27727.json

Published

Feb 25, 2026

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27709NanaZip is an open source file archive. Starting in version …6.6
• CVE-2026-2771Undefined behavior in the DOM: Core & HTML component. This v…9.8
• CVE-2026-27710NanaZip is an open source file archive. Starting in version …5
• CVE-2026-27711NanaZip is an open source file archive. Starting in version …6.6
• CVE-2026-2772Use-after-free in the Audio/Video: Playback component. This …9.8
• CVE-2026-27723OpenProject is an open-source, web-based project management …5.3
• CVE-2026-27728OneUptime is a solution for monitoring and managing online s…8.8
• CVE-2026-27729Astro is a web framework. In versions 9.0.0 through 9.5.3, A…7.5
• CVE-2026-2773Incorrect boundary conditions in the Web Audio component. Th…9.8
• CVE-2026-27730esm.sh is a no-build content delivery network (CDN) for web …7.5
• CVE-2026-27732WWBN AVideo is an open source video platform. Prior to versi…8.1
• CVE-2026-27734Beszel is a server monitoring platform. Prior to version 0.1…6.5