CVE-2026-55223: swaldman c3p0 deserialization gadget sink in DataSource properties

CVE-2026-55223 · Severity: medium · CVSS 4 · Published 2026-06-30

c3p0 is a library used by Java applications to manage database connections. In versions prior to 0.14.0, it contains a flaw that allows it to be used as a 'sink' in a deserialization attack. If an attacker can send specially crafted data to an application that uses c3p0 alongside other specific libraries, they could potentially trigger unauthorized actions or compromise the server. This risk is higher if the application also uses older versions of Java or certain common utility libraries like Apache Commons BeanUtils.

Technologies: com.mchange:c3p0 (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-55223 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55223 being exploited in the wild.
How severe is CVE-2026-55223?
Medium severity, with a CVSS score of 4, published 30 June 2026.
Which products and versions are affected?
com.mchange:c3p0 (Maven) < 0.14.0, ECOSYSTEM:introduced=0,fixed=0.14.0.
Is there a fix for CVE-2026-55223?
Yes. com.mchange:c3p0 (Maven): upgrade to 0.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55223 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55223?
Check whether you run com.mchange:c3p0 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.mchange:c3p0 (Maven): upgrade to 0.14.0 or later
    # set com.mchange:c3p0 to 0.14.0 in your pom.xml or build.gradle

Technical details

The vulnerability stems from c3p0's implementation of the JDBC DataSource and ConnectionPoolDataSource interfaces. Because methods like getConnection() follow the JavaBean 'getXXX' naming convention, they are treated as properties by introspection libraries. An attacker can craft a malicious serialized object that, when deserialized by an application using a 'carrier' library (like Apache Commons BeanUtils), triggers these methods. If a vulnerable JDBC driver is also present on the classpath, this can lead to an exploit. The fix in version 0.14.0 introduces explicit BeanInfo classes that exclude these sensitive methods from introspection, preventing them from being called during automated property lookups.

Affected products

  • swaldman c3p0 < 0.14.0

Identifiers

  • CVE-2026-55223
  • GHSA-w6w4-rjh9-9r58

Timeline

  • 2026-06-11: disclosed: Advisory published by vendor
  • 2026-06-11: patched: Version 0.14.0 released
  • 2026-06-30: advisory: NVD published CVE-2026-55223

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.