Skip to content
OpenAdvisories

Package · Ubuntu

c3p0

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.1
    CVE-2026-55153

    mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

    mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbi…

    swaldman mchange-commons-java debezium-3.5-connector-jdbc c3p0 Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2026-55223

    c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

    c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection(…

    swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven
  • High 8.9
    CVE-2026-27830

    c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

    c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…

    swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven
  • High 8.9
    CVE-2026-27727

    mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

    mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appl…

    swaldman mchange-commons-java c3p0 com.mchange:mchange-commons-java Ubuntu Maven
  • High 7.5
    CVE-2019-5427 Public exploit

    Billion laughs attack in c3p0

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven
  • Critical 9.8
    CVE-2018-20433 Public exploit

    XML External Entity Reference in mchange:c3p0

    c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

    c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven