debian/c3p0 vulnerabilities

Latest debian/c3p0 CVEs

Newest publication first

1. CVE-2026-55223 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

   Published 2026-06-30

   Medium·CVSS 6.3 EPSS 0.48%

   c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX()...

2. CVE-2026-27830 c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

   Published 2026-02-26

   High·CVSS 8.9 EPSS 0.60%

   c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents...

3. CVE-2019-5427 Billion laughs attack in c3p0

   Published 2019-04-22

   High·CVSS 7.5 EPSS 4.9%

   c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

4. DLA-1621-1 c3p0 - security update

   Published 2018-12-28

   Unknown

5. CVE-2018-20433 XML External Entity Reference in mchange:c3p0

   Published 2018-12-24

   Critical·CVSS 9.8 EPSS 4.6%

   c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.