The mchange-commons-java library contains code that mirrors early JNDI implementations, including support for remote factoryClassLocation values that enable code download and execution within a running Java application. Unlike the JDK, which disables this functionality by default via the com.sun.jndi.ldap.object.trustURLCodebase system property, mchange-commons-java's independent JNDI dereferencing implementation can be exploited to execute arbitrary code if an attacker can induce the application to process a malicious jaxax.naming.Reference or serialized object. This vulnerability is present in versions prior to 0.4.0, which lack the restrictive configuration parameters introduced in later versions to mitigate this risk. The vulnerability is tracked as CVE-2026-27727 with a CVSS 4.0 score of 8.9 (high severity).

Successful exploitation allows an attacker with the ability to supply malicious serialized objects or JNDI references to cause the application to download and execute arbitrary code. This can lead to full compromise of the affected application environment. The vulnerability bypasses JDK mitigations because mchange-commons-java uses its own JNDI dereferencing implementation. There are no known exploits in the wild at this time.

Upgrade all instances of mchange-commons-java to version 0.4.0 or later, which includes restrictive default configuration parameters that disable unsafe JNDI dereferencing behavior. Avoid using versions prior to 0.4.0 on application CLASSPATHs. No known workarounds exist. Refer to the vendor advisories for detailed update instructions. Since this is a library vulnerability, remediation requires updating the library in the application and rebuilding or redeploying affected software.