CVE-2026-27727

{"id": "CVE-2026-27727", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-25T17:25:39.910", "references": [{"url": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.mchange.com/projects/c3p0/#configuring_security", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://www.mchange.com/projects/c3p0/#security-note", "tags": ["Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs."}, {"lang": "es", "value": "mchange-commons-java, una librer\u00eda que proporciona utilidades de Java, incluye c\u00f3digo que emula implementaciones tempranas de la funcionalidad JNDI, incluyendo soporte para valores remotos de `factoryClassLocation`, mediante los cuales se puede descargar e invocar c\u00f3digo dentro de una aplicaci\u00f3n en ejecuci\u00f3n. Si un atacante puede provocar que una aplicaci\u00f3n lea un `jaxax.naming.Reference` o un objeto serializado maliciosamente dise\u00f1ado, pueden provocar la descarga y ejecuci\u00f3n de c\u00f3digo malicioso. Las implementaciones de esta funcionalidad dentro del JDK fueron deshabilitadas por defecto detr\u00e1s de una propiedad de sistema que por defecto es `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. Sin embargo, dado que mchange-commons-java incluye una implementaci\u00f3n independiente de la desreferenciaci\u00f3n JNDI, las librer\u00edas (como c3p0) que resuelven referencias a trav\u00e9s de esa implementaci\u00f3n podr\u00edan ser provocadas para descargar y ejecutar c\u00f3digo malicioso incluso despu\u00e9s de que el JDK fuera reforzado. Emulando el parche del JDK, la funcionalidad JNDI de mchange-commons-java est\u00e1 restringida por par\u00e1metros de configuraci\u00f3n que por defecto tienen valores restrictivos a partir de la versi\u00f3n 0.4.0. No se conocen soluciones alternativas disponibles. Las versiones anteriores a la 0.4.0 deben evitarse en los CLASSPATH de las aplicaciones."}], "lastModified": "2026-03-11T23:30:53.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mchange:mchange_commons_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B71153F-8D1C-4723-A9BD-4B92CFFE0A98", "versionEndExcluding": "0.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}