CVE-2026-55153 is a vulnerability in mchange-commons-java that enables JNDI injection and deserialization gadget abuse. Prior to version 0.6.0, the library includes a JNDI ObjectFactory implementation willing to construct objects of arbitrary classes and initialize JavaBean-style properties, which can be used to provoke an HTTP GET on an arbitrary URL. Additionally, prior to version 0.5.0, the same library would interpret BinaryRefAddress elements as Java-serialized objects and deserialize unexpected objects that potentially execute malicious behavior on initialization. This vulnerability is aggravated by mchange-commons-java's ReferenceIndirector, which can be used to smuggle in malicious JNDI Reference objects for dereferencing by applications. Affected versions include all prior to 0.6.0. The vulnerability allows an attacker to arrange for an application to lookup a malicious JNDI Reference or deserialize a malicious Java-serialized object, potentially leading to remote code execution or other security issues. This is particularly concerning as it can be used to trigger well-known deserialization gadget chains involving other libraries. Upgrading to the current version of mchange-commons-java is strongly recommended.
We recommend you to update mchange-commons-java to version 0.6.0.[/subscribe_to_unlock_form]
CVE-2026-55153 is a vulnerability in mchange-commons-java that enables JNDI injection and deserialization gadget abuse. Prior to version 0.6.0, the library includes a JNDI ObjectFactory implementation willing to construct objects of arbitrary classes and initialize JavaBean-style properties, which can be used to provoke an HTTP GET on an arbitrary URL. Additionally, prior to version 0.5.0, the same library would interpret BinaryRefAddress elements as Java-serialized objects and deserialize unexpected objects that potentially execute malicious behavior on initialization. This vulnerability is aggravated by mchange-commons-java's ReferenceIndirector, which can be used to smuggle in malicious JNDI Reference objects for dereferencing by applications. Affected versions include all prior to 0.6.0. The vulnerability allows an attacker to arrange for an application to lookup a malicious JNDI Reference or deserialize a malicious Java-serialized object, potentially leading to remote code execution or other security issues. This is particularly concerning as it can be used to trigger well-known deserialization gadget chains involving other libraries. Upgrading to the current version of mchange-commons-java is strongly recommended.
We recommend you to update mchange-commons-java to version 0.6.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]