PT-2026-22063 · C3P0+1 · C3P0+1

Dpp · Published 2026-02-25 · Updated 2026-03-20 · CVE-2026-27830

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions c3p0 versions prior to 0.12.0

Description c3p0, a JDBC Connection pooling library, is susceptible to attack through maliciously crafted Java-serialized objects and javax.naming.Reference instances. Specifically, the userOverridesAsString property in several ConnectionPoolDataSource implementations, which represents a Map<String,Map<String,String>>, was previously maintained as a hex-encoded serialized object. An attacker who can modify this property, either directly or through malicious serialized objects or javax.naming.Reference instances, could potentially execute arbitrary code on the application's CLASSPATH. This risk is amplified by vulnerabilities in c3p0's dependency, mchange-commons-java, which includes JNDI functionality with ungated support for remote factoryClassLocation values. Attackers could leverage this to set userOverridesAsString with objects indirectly serialized via JNDI references, leading to the download and execution of malicious code from a remote factoryClassLocation. The use of Java-serialized-object hex encoding for a writable Java-Bean property exposed across JNDI interfaces is a significant security concern.

Recommendations Upgrade to c3p0 version 0.12.0 or later.

Exploit

Fix

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

CVE-2026-27830

GHSA-5476-XC4J-RQCV

OESA-2026-1691

SUSE-SU-2026:0855-1

SUSE-SU-2026:1035-1

Affected Products

C3P0

Mchange-Commons-Java

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27830.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-27830 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27830 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5476-xc4j-rqcv · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27830 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1691 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27830 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27830 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0855-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27830 · Security Note
• https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e · Note
• https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv · Note
• https://github.com/swaldman/c3p0 · Note
• https://bugzilla.suse.com/1258942 · Note