mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8642-1 advisory.

    It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized     objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security     restrictions, or cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0
    connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation
    (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize
    "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization
    gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of
    a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke
    an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is
    aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be
    smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been
    resolved in version 0.6.0. (CVE-2026-55153)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0     connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation     (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize     JavaBean-style properties, which for certain classes enables JNDI injection and deserialization     gadgets. Such initialization is unsafe for some classes: for example, setting the contentType property of     a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke     an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is     aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be     smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been     resolved in version 0.6.0. (CVE-2026-55153)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365425	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : c3p0 vulnerabilities (USN-8642-1)	Nessus	Ubuntu Local Security Checks	Local	high
445982	SCA: security update for com.mchange:mchange-commons-java (GHSA-h84g-69h7-mw6v)	Tenable Cloud Security	SCA Checks	Local	high
445982	SCA: security update for com.mchange:mchange-commons-java (GHSA-h84g-69h7-mw6v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324914	Linux Distros Unpatched Vulnerability : CVE-2026-55153	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55153

high

Tenable Plugins

high

high

high

high