CVE-2026-55223 Details
Description
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.
A deserialization vulnerability has been identified in the c3p0 JDBC connection pooling library, affecting versions prior to 0.14.0. This vulnerability arises when c3p0 is used with certain libraries that can create a 'sink' for deserialization gadgets. The issue exploits the JDBC specification's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() methods, which are treated as 'properties' by JavaBean libraries, leading to unintended interactions with JDBC drivers. Attackers can craft malicious DataSource objects that, when deserialized, invoke vulnerable JDBC drivers, potentially leading to exploitation. The vulnerability requires a susceptible DataSource or ConnectionPoolDataSource, a vulnerable JDBC driver, and a deserialization context that automatically resolves JavaBean properties, such as a collection with an Apache commons-beanutils Comparator. c3p0 versions 0.14.0 and above include fixes that prevent this type of attack by excluding connection-related properties from JavaBean introspection.
Upgrade to c3p0 version 0.14.0 or later, which includes the necessary fixes to prevent this vulnerability. After upgrading, verify that the application no longer exposes the vulnerable DataSource or ConnectionPoolDataSource properties.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27 | [email protected] | Source CodeVendor |
| https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| c3p0 | < 0.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |