CriticalFix available
c3p0 — security advisory
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.
- Products
- c3p0
- Affected versions
- 0.9.1.2-10, 0.9.1.2-10ubuntu0.20.04.1, 0.9.1.2-10ubuntu1, 0.9.1.2-10ubuntu2, 0.9.1.2-11, 0.9.1.2-9, 0.9.1.2-9+deb8u1build0.16.04.1, 0.9.1.2-9+deb8u1build0.18.04.1, 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1, 0.9.1.2-9+deb8u1ubuntu0.18.04.1
- Fixed versions
- 0.9.1.2-10ubuntu0.20.04.1+esm1, 0.9.1.2-10ubuntu1+esm1, 0.9.1.2-10ubuntu2+esm1, 0.9.1.2-11ubuntu0.1~esm1, 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2, 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
- CVEs
- CVE-2026-27727
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:58 UTC · Revision 1
Source evidence
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.
osv:UBUNTU-CVE-2026-27727
c3p0
Fixed versions: 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2
c3p0
Fixed versions: 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
c3p0
Fixed versions: 0.9.1.2-10ubuntu0.20.04.1+esm1
c3p0
Fixed versions: 0.9.1.2-10ubuntu1+esm1
c3p0
Fixed versions: 0.9.1.2-10ubuntu2+esm1
c3p0
Fixed versions: Not specified
c3p0
Fixed versions: Not specified
c3p0
Fixed versions: 0.9.1.2-11ubuntu0.1~esm1
Complete source record
{
"id": "2056534fa61303ccebd78053883b83eb2237fe2504e51d1006910bc1f17b182a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-27727",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-27727",
"summary": "mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.",
"evidence": "osv:UBUNTU-CVE-2026-27727",
"products": [
{
"name": {
"value": "c3p0",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "0.9.1.2-9",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.1.2-9+deb8u1build0.16.04.1",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "0.9.1.2-9",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.1.2-9+deb8u1build0.18.04.1",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.1.2-9+deb8u1ubuntu0.18.04.1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.1.2-10ubuntu0.20.04.1+esm1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "0.9.1.2-10",
"evidence": "/affected/2/versions"
},
{
"value": "0.9.1.2-10ubuntu0.20.04.1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.1.2-10ubuntu1+esm1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "0.9.1.2-10",
"evidence": "/affected/3/versions"
},
{
"value": "0.9.1.2-10ubuntu1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.1.2-10ubuntu2+esm1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "0.9.1.2-10ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "0.9.1.2-10ubuntu2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.1.2-10ubuntu2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.1.2-11",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "c3p0",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.1.2-11ubuntu0.1~esm1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": [
{
"value": "0.9.1.2-10ubuntu2",
"evidence": "/affected/7/versions"
},
{
"value": "0.9.1.2-11",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2026-27727",
"aliases": [
"UBUNTU-CVE-2026-27727"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=esm-apps-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"0.9.1.2-9",
"0.9.1.2-9+deb8u1build0.16.04.1",
"0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"0.9.1.2-9",
"0.9.1.2-9+deb8u1build0.18.04.1",
"0.9.1.2-9+deb8u1ubuntu0.18.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1.2-10ubuntu0.20.04.1+esm1"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"0.9.1.2-10",
"0.9.1.2-10ubuntu0.20.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu0.20.04.1+esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1.2-10ubuntu1+esm1"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"0.9.1.2-10",
"0.9.1.2-10ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu1+esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1.2-10ubuntu2+esm1"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"0.9.1.2-10ubuntu1",
"0.9.1.2-10ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu2+esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.9.1.2-10ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.9.1.2-11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-11"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1.2-11ubuntu0.1~esm1"
}
]
}
],
"package": {
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"0.9.1.2-10ubuntu2",
"0.9.1.2-11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27727.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-11ubuntu0.1~esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
}
],
"modified": "2026-10-17T12:59:56.659875066Z",
"provider": "osv",
"upstream": [
"CVE-2026-27727"
],
"references": [
"https://ubuntu.com/security/CVE-2026-27727",
"https://www.cve.org/CVERecord?id=CVE-2026-27727",
"https://ubuntu.com/security/notices/USN-8642-1"
]
},
"related_cves": [
{
"value": "CVE-2026-27727",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/2/score"
},
"source_id": "core-osv",
"document_id": 360014,
"published_at": "2026-02-25T17:25:00+00:00"
}