A flaw in mchange-commons-java prior to version 0.6.0 allows its JNDI ObjectFactory to instantiate arbitrary Java classes and set JavaBean-style properties without validation. When these properties belong to classes that perform side effects—such as Swing’s JEditorPane—the initialization can trigger external HTTP requests, enabling the attacker to transport data from a compromised application. This same vulnerable factory, together with the library’s ReferenceIndirector, permits an attacker to supply malicious JNDI references or serialized data containing deserialization gadgets, thereby creating a potential for arbitrary code execution.

swaldman:mchange-commons-java versions prior to 0.6.0 are vulnerable. The library is used by the c3p0 connection pool and other mchange projects; applications that rely on these connection pools may be affected. The vulnerability is not tied to a particular operating system or runtime; based on the description it is inferred that the flaw could surface on any Java environment that processes untrusted data through this library.

The CVSS score is 7.1. The EPSS score of less than 1 % reflects a low current exploitation probability. The issue is not listed in the CISA KEV catalog. Attackers could craft payloads that the application processes, possibly leading to arbitrary code execution or unauthorized network activity. Based on the description, it is inferred that the attack vector is likely through injection of JNDI references or untrusted serialized data, and the vulnerability applies across available operating systems and Java runtimes.