Unsafe Deserialization in com.mchange:c3p0 (CVE-2026-55223)
Summary
Vulnerability in com.mchange:c3p0 (CVE-2026-55223). Risk of unauthorized operations or information disclosure. Exploitable via DataSource. Mitigation: upgrade to 0.14.0 or later.
Original description
The description as published by the source.
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-55223 has been found in com.mchange:c3p0.
Attackers can target a specific entry point like DataSource over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade com.mchange:c3p0 to 0.14.0 or later.
If unsure, ask your IT team or search "com.mchange:c3p0 CVE-2026-55223" on the vendor's site.
CVE-2026-55223 (com.mchange:c3p0) — CWE-502
Attack surface: DataSource / ConnectionPoolDataSource / CLASSPATH / Comparator
Patched: 0.14.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Unsafe deserialization (CWE-502) exists in com.mchange:c3p0. Attackers reach the vulnerable code path via DataSource.
Check the vendor advisory for the affected versions of com.mchange:c3p0. Attack surface: DataSource / ConnectionPoolDataSource / CLASSPATH / Comparator.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 0.14.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで com.mchange:c3p0 を使っているサービスとバージョンを洗い出す。
-
2Apply patch patch
Upgrade com.mchange:c3p0 to 0.14.0ステージング環境で 0.14.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-55223 c3p0
- Ubuntu UBUNTU-CVE-2026-55223 c3p0 Fixed in: 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web github.com