mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0
    connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation
    (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize
    "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization
    gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of
    a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke
    an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is
    aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be
    smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been
    resolved in version 0.6.0. (CVE-2026-55153)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0     connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation     (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize     JavaBean-style properties, which for certain classes enables JNDI injection and deserialization     gadgets. Such initialization is unsafe for some classes: for example, setting the contentType property of     a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke     an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is     aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be     smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been     resolved in version 0.6.0. (CVE-2026-55153)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445982	SCA: security update for com.mchange:mchange-commons-java (GHSA-h84g-69h7-mw6v)	Tenable Cloud Security	SCA Checks	Local	high
445982	SCA: security update for com.mchange:mchange-commons-java (GHSA-h84g-69h7-mw6v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324914	Linux Distros Unpatched Vulnerability : CVE-2026-55153	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55153

high

Tenable Plugins

high

high

high