mchange-commons-java 注入漏洞

🗓️ 25 Feb 2026 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 7 Views

mchange-commons-java before 0.4.0 had a naming dereferencing vulnerability enabling code download and execution via crafted Reference objects.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CVE-2026-27727)	17 Jun 202614:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses c3p0-0.11.2.jar and mchange-commons-java-0.3.2.jar which are vulnerable to CVE-2026-27830 and CVE-2026-27727.	30 Mar 202607:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:11	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Apache Tomcat and mchange-commons-java, IBM ApplinX is vulnerable to Improper Input Validation vulnerablities (CVE-2025-66614, CVE-2026-24733, CVE-2026-24734) and an 'Injection' vulnerability (CVE-2026-27727).	8 Apr 202609:12	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of mchange-commons-java, IBM webMethods BPM is vulnerable to malicious code execution (CVE-2026-27727).	26 May 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses c3p0-0.11.2.jar and mchange-commons-java-0.3.2.jar which are vulnerable to CVE-2026-27830 and CVE-2026-27727.	16 Apr 202613:08	–	ibm
ATTACKERKB	CVE-2026-27727	25 Feb 202616:01	–	attackerkb
Atlassian	RCE (Remote Code Execution) at mchange-commons-java dependency in Bamboo Data Center	12 May 202600:31	–	atlassian
Atlassian	RCE (Remote Code Execution) at mchange-commons-java dependency in Crucible Server	14 Apr 202604:29	–	atlassian
Chainguard	CVE-2026-27727 vulnerabilities	27 Feb 202607:17	–	cgr

Source	Link
github	www.github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44
mogwailabs	www.mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal
mchange	www.mchange.com/projects/c3p0/
mchange	www.mchange.com/projects/c3p0/
oracle	www.oracle.com/security-alerts/cpuapr2026.html

28 May 2026 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 3.19.8

CVSS 48.9

EPSS0.00577

SSVC

mchange-commons-java before 0.4.0 naming dereferencing reference objects code execution vulnerability