CVE-2026-27830

[CVE catalog]

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Severity

High · CVSS 8.9CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Feb 25, 2026, 5:25:39 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.60% · Oct 27, 2026

{
  "package_releases": [
    {
      "name": "c3p0",
      "status": "vulnerable",
      "release": "sid",
      "version": "0.9.1.2-11"
    },
    {
      "name": "c3p0",
      "status": "vulnerable",
      "release": "forky",
      "version": "0.9.1.2-11"
    },
    {
      "name": "c3p0",
      "status": "vulnerable",
      "release": "trixie",
      "version": "0.9.1.2-10.1"
    },
    {
      "name": "c3p0",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "0.9.1.2-10.1~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1129318,
      "name": "c3p0",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1129318,
      "name": "c3p0",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1129318,
      "name": "c3p0",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1129318,
      "name": "c3p0",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "com.mchange:c3p0",
      "ecosystem": "maven",
      "fixed_version": "0.12.0"
    },
    {
      "name": "c3p0",
      "ecosystem": "cpe",
      "fixed_version": "not yet fixed"
    },
    {
      "name": "c3p0",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "0.9.1.2-10ubuntu2+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "0.9.1.2-10ubuntu2+esm1"
    },
    {
      "name": "libc3p0-java",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "0.9.1.2-10ubuntu2+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "0.9.1.2-10ubuntu2+esm1"
    },
    {
      "name": "libc3p0-java-doc",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "0.9.1.2-10ubuntu2+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "0.9.1.2-10ubuntu2+esm1"
    }
  ]
}