CVE-2026-55153: JNDI Injection and Deserialization Gadget Abuse in mchange-commons-java

Vulnerability ID: CVE-2026-55153
CVSS Score: 7.1
Published: 2026-08-14

A JNDI Injection and Deserialization Gadget vulnerability exists in mchange-commons-java prior to version 0.6.0. The com.mchange.v2.naming.JavaBeanObjectFactory component permits arbitrary class instantiation and setter invocation, allowing attackers to perform Server-Side Request Forgery (SSRF) and remote class loading.

TL;DR

Unsafe reflection and dynamic instantiation in mchange-commons-java's JavaBeanObjectFactory allows attackers to trigger SSRF and JNDI injection via crafted object references.

Technical Details

• CWE ID: CWE-502, CWE-470
• Attack Vector: Adjacent Network
• CVSS Score: 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
• Exploit Status: None (No public exploits available)
• CISA KEV Status: Not Listed
• Affected Versions: < 0.6.0

Affected Systems

• Java applications utilizing mchange-commons-java naming or serialization components
• mchange-commons-java: < 0.6.0 (Fixed in: 0.6.0)

Mitigation Strategies

• Upgrade mchange-commons-java to version 0.6.0 or higher
• Configure strict class whitelisting via system properties
• Disable support for remote factory class locations

Remediation Steps:

1. Identify any usage of mchange-commons-java versions prior to 0.6.0.
2. Update dependency declarations in pom.xml or build.gradle to specify version 0.6.0.
3. Add the system property -Dcom.mchange.v2.naming.referenceableJavaBeanClassWhitelist with a list of authorized class names.
4. Verify that remote factory loading is disabled by setting -Dcom.mchange.v2.naming.supportReferenceRemoteFactoryClassLocation=false.

Read the full report for CVE-2026-55153 on our website for more details including interactive diagrams and full exploit analysis.