Junglewise Threat Intelligence

CVE-2026-27830: swaldman c3p0 insecure deserialization in userOverridesAsString

CVE-2026-27830 · Severity: high · CVSS 8 · Published 2026-02-26

Technologies: Swaldman C3p0.

Executive brief

c3p0 is a widely used Java library that helps applications manage database connections efficiently. A security flaw in older versions allows an attacker to provide specially crafted data that the library then processes as a Java object. This can lead to the execution of malicious code on the server, potentially allowing an attacker to take full control of the application, access sensitive data, or disrupt operations.

Technical details

c3p0 prior to v0.12.0 is vulnerable to insecure deserialization and JNDI injection. The 'userOverridesAsString' property in several ConnectionPoolDataSource implementations was stored as a hex-encoded serialized Java object. An attacker with the ability to modify this property can provide a malicious serialized object or a javax.naming.Reference instance. The vulnerability is exacerbated by the mchange-commons-java dependency, which contains JNDI-like functionality that supports ungated remote 'factoryClassLocation' values. This allows an attacker to trigger the download and execution of arbitrary bytecode from a remote server, bypassing modern JDK JNDI restrictions. The issue is fixed in c3p0 v0.12.0, which switches to a CSV-based format and utilizes a hardened version of mchange-commons-java (0.4.0+).

Affected products

  • swaldman c3p0 < 0.12.0
  • swaldman c3p0-loom < 0.12.0

Timeline

  • 2026-02-23: advisory: GitHub Security Advisory published
  • 2026-02-26: disclosed: CVE-2026-27830 published to NVD

References