HIGH 7.1 GitHub
CVE-2026-55153
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
### Impact
Prior to version 0.6.0, mchange-commons-java includes a JNDI `ObjectFactory` implementation (`com.mchange.v2.naming.JavaBeanObjectFactory`) willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is unsafe. For example, setting the "contentType" property of a Swing `JEditorPane` to `text/html` and the "text" property to HTML containing a stylesheet <link> will provoke an HTTP GET on an
Affected Products
- maven/com.mchange:mchange-commons-java < 0.6.0
References
- https://github.com/advisories/GHSA-h84g-69h7-mw6v
- https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-h84g-69h7-mw6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-55153
- https://github.com/advisories/GHSA-h84g-69h7-mw6v
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-14 via GitHub. Affected: maven/com.mchange:mchange-commons-java < 0.6.0.
vulnfeed aggregates 10939 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.