mchange has 3 CVEs on record. 1 was published in the last 90 days. The median CVSS is 8.4 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Products
- com.mchange:c3p0 1
- com.mchange:mchange-commons-java 1
- mchange_commons_java 1
3
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-27727Critical· 9.8mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked…66CVE-2026-55153High· 7.1mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"39CVE-2026-55223Mediumc3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets28
mchange vulnerabilities
CVEs affecting mchange, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-55153High· 7.1mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
▾ Twilightmchange · com.mchange:mchange-commons-javaEPSS 0.19%via GHSA
CVE-2026-55223Mediumc3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
▾ Sunlitmchange · com.mchange:c3p0EPSS 0.48%via GHSA
CVE-2026-27727Critical· 9.8PoCmchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked…
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked…
▾ Abyssalmchange · mchange_commons_javaEPSS 0.98%via NVD