What is CVE-2026-55153?

CVE-2026-55153 is a high-severity vulnerability in Swaldman Mchange-commons-java, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 7.1/10. Published 2026-07-01.

How severe is CVE-2026-55153?

High severity. CVSS v3 base score is 7.1 out of 10.

Deserialization in Swaldman Mchange-commons-java

CVE-2026-55153

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will const…

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Swaldman Mchange-commons-java — versions < 0.6.0

Weakness classification (CWE)

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
CWE-502 — Deserialization of Untrusted Data

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-55153?: CVE-2026-55153 is a high-severity vulnerability in Swaldman Mchange-commons-java, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 7.1/10. Published 2026-07-01.
How severe is CVE-2026-55153?: High severity. CVSS v3 base score is 7.1 out of 10.