Skip to content
OpenAdvisories

Product · swaldman

c3p0

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.9
    CVE-2026-27830

    c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

    c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…

    swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven