8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27727

CVE-2026-27727: mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote factoryClassLocation values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted jaxax.naming.Reference or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to false, com.sun.jndi.ldap.object.trustURLCodebase. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27727

CVE-2026-27727:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.mchange:mchange-commons-java	maven	< 0.4.0	0.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the com.mchange.v2.naming.ReferenceableUtils.referenceToObject method. The description points to an RCE vulnerability due to JNDI reference resolution, similar to the one patched in the JDK. The analysis of the commits between the vulnerable version 0.3.2 and the patched version 0.4.0 confirms this. Specifically, commit e16e768dc85641550cf6280057509ff10fd47880 directly addresses the remote class loading issue. Before the patch, the referenceToObject method would unconditionally create a URLClassLoader using the factoryClassLocation from the untrusted Reference object. This allows an attacker to specify a URL to a malicious JAR file, leading to remote code execution. The patch introduces a security control, supportReferenceRemoteFactoryClassLocation, which is disabled by default, to prevent this behavior. Another commit, 177edace95374759a4d82782e1954546cfb71a2b, adds a whitelisting mechanism for factory classes as a defense-in-depth measure. The primary vulnerable function is com.mchange.v2.naming.ReferenceableUtils.referenceToObject as it is the entry point for the deserialization and processing of the malicious object.

Vulnerable functions

com.mchange.v2.naming.ReferenceableUtils.referenceToObject

src/main/java/com/mchange/v2/naming/ReferenceableUtils.java

The `referenceToObject` function is vulnerable to remote code execution. It processes a `javax.naming.Reference` object and, if a `factoryClassLocation` is provided, it creates a `URLClassLoader` to load a class from the specified remote location. An attacker can craft a malicious `Reference` object with a hostile `factoryClassLocation` to trick the application into loading and executing arbitrary code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.