The vulnerability in mchange-commons-java arises from its implementation of JNDI dereferencing that supports remote factoryClassLocation values, enabling code download and execution within a running Java application. Unlike the JDK's JNDI implementation, which disables this functionality by default via the com.sun.jndi.ldap.object.trustURLCodebase system property, mchange-commons-java's independent JNDI dereferencing can be exploited even when the JDK is hardened. An attacker who can cause an application to read a malicious jaxax.naming.Reference or serialized object can trigger arbitrary code execution. Starting with version 0.4.0, the library introduced restrictive configuration parameters to mitigate this risk. Versions prior to 0.4.0 remain vulnerable. No known workarounds are available. The CVSS 4.0 base score is 8.9, reflecting high impact and ease of exploitation with partial attacker privileges.

Successful exploitation allows an attacker with partial privileges to provoke the application to download and execute arbitrary malicious code remotely. This can lead to full compromise of the affected application environment. The vulnerability bypasses JDK-level mitigations due to the library's independent JNDI dereferencing implementation. The impact includes high confidentiality, integrity, and availability risks.

Avoid using mchange-commons-java versions prior to 0.4.0 on application classpaths. Upgrade to version 0.4.0 or later, which includes restrictive configuration parameters that disable unsafe JNDI dereferencing by default. No known workarounds exist. Review application dependencies for usage of vulnerable versions and update accordingly. Monitor vendor advisories for any additional patches or guidance.