CVE-2026-27830: swaldman c3p0 insecure deserialization in userOverridesAsString

CVE-2026-27830 · Severity: high · CVSS 8 · Published 2026-02-26

c3p0 is a widely used Java library that helps applications manage database connections efficiently. A security flaw in older versions allows an attacker to provide specially crafted data that the library then processes as a Java object. This can lead to the execution of malicious code on the server, potentially allowing an attacker to take full control of the application, access sensitive data, or disrupt operations.

Technologies: com.mchange:c3p0 (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-27830 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27830 being exploited in the wild.
How severe is CVE-2026-27830?
High severity, with a CVSS score of 8, published 26 February 2026.
Which products and versions are affected?
com.mchange:c3p0 (Maven) ECOSYSTEM:introduced=0,fixed=0.12.0; Steve Waldman C3p0-Loom < 0.12.0.
Is there a fix for CVE-2026-27830?
Yes. com.mchange:c3p0 (Maven): upgrade to 0.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27830 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-27830?
Check whether you run com.mchange:c3p0 (Maven) or Steve Waldman C3p0-Loom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.mchange:c3p0 (Maven): upgrade to 0.12.0 or later
    # set com.mchange:c3p0 to 0.12.0 in your pom.xml or build.gradle

Technical details

c3p0 prior to v0.12.0 is vulnerable to insecure deserialization and JNDI injection. The 'userOverridesAsString' property in several ConnectionPoolDataSource implementations was stored as a hex-encoded serialized Java object. An attacker with the ability to modify this property can provide a malicious serialized object or a javax.naming.Reference instance. The vulnerability is exacerbated by the mchange-commons-java dependency, which contains JNDI-like functionality that supports ungated remote 'factoryClassLocation' values. This allows an attacker to trigger the download and execution of arbitrary bytecode from a remote server, bypassing modern JDK JNDI restrictions. The issue is fixed in c3p0 v0.12.0, which switches to a CSV-based format and utilizes a hardened version of mchange-commons-java (0.4.0+).

Affected products

  • swaldman c3p0 < 0.12.0
  • swaldman c3p0-loom < 0.12.0

Identifiers

  • CVE-2026-27830
  • GHSA-5476-xc4j-rqcv

Timeline

  • 2026-02-23: advisory: GitHub Security Advisory published
  • 2026-02-26: disclosed: CVE-2026-27830 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.