mchange-commons-java vulnerabilities

2 known vulnerabilities in mchange-commons-java from Swaldman. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  mchange-commons-java: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-55153Jul 1, 2026Swaldman

  mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbit

• 9.8 Critical severity

  mchange-commons-java: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-27727Feb 25, 2026Swaldman

  mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appli