Skip to content
OpenAdvisories

Package · Debian

c3p0

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-55223

    c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

    c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection(…

    swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven