Skip to content
OpenAdvisories
High USN-7571-1 1 CVE

c3p0 vulnerability

Published Jun 16, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Aaron Massey discovered that c3p0 could be made to crash when parsing
certain input. An attacker able to modify the application’s XML
configuration file could possibly use this issue to cause a denial of
service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS c3p0 0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2019-5427 Public exploit

    Billion laughs attack in c3p0

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2019-5427