Skip to content
OpenAdvisories

Package · Debian

c3p0

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.3
    CVE-2026-55223

    c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

    c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection(…

    swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven
  • High 8.9
    CVE-2026-27830

    c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

    c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…

    swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven
  • High 7.5
    CVE-2019-5427 Public exploit

    Billion laughs attack in c3p0

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven
  • Critical 9.8
    CVE-2018-20433 Public exploit

    XML External Entity Reference in mchange:c3p0

    c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven