CVE-2026-27830: CWE-502: Deserialization of Untrusted Data in swaldman c3p0
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.
AI Analysis
Technical Summary
The vulnerability in c3p0 (CVE-2026-27830) arises from unsafe deserialization of maliciously crafted Java-serialized objects and javax.naming.Reference instances via the userOverridesAsString property in ConnectionPoolDataSource classes. Prior to version 0.12.0, this property was stored as a hex-encoded serialized object, allowing attackers with the ability to reset it or supply malicious serialized data to execute arbitrary code on the application's classpath. The threat is exacerbated by vulnerabilities in the mchange-commons-java dependency, which includes early JNDI implementations permitting remote factoryClassLocation values, enabling attackers to trigger remote code loading and execution through JNDI dereferencing. Starting with c3p0 0.12.0, the userOverridesAsString property uses a safe CSV-based format, and the dependency mchange-commons-java 0.4.0+ enforces restrictive configuration to block remote JNDI references. Additionally, c3p0 enforces the mchange-commons-java nameGuardClassName to prevent injection of unexpected JNDI names. There is no supported workaround for versions prior to 0.12.0, making upgrading essential to mitigate this vulnerability.
Potential Impact
Successful exploitation allows attackers with limited privileges (low privileges required) to execute arbitrary code on the application's classpath by exploiting unsafe deserialization and JNDI dereferencing. This can lead to complete compromise of the affected application environment. The vulnerability has a high CVSS 4.0 score of 8.9, reflecting high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fixed version of c3p0 is available starting from version 0.12.0, which replaces the vulnerable userOverridesAsString property format with a safe CSV-based format and depends on mchange-commons-java 0.4.0 or later that restricts remote JNDI references by default. Users should upgrade to c3p0 version 0.12.0 or later to remediate this vulnerability. There is no supported workaround for versions prior to 0.12.0. Review and apply vendor advisories and errata, such as those from Red Hat, for relevant patches and updates.
CVE-2026-27830: CWE-502: Deserialization of Untrusted Data in swaldman c3p0
Description
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.
CVSS v4.0
Score 8.9high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in c3p0 (CVE-2026-27830) arises from unsafe deserialization of maliciously crafted Java-serialized objects and javax.naming.Reference instances via the userOverridesAsString property in ConnectionPoolDataSource classes. Prior to version 0.12.0, this property was stored as a hex-encoded serialized object, allowing attackers with the ability to reset it or supply malicious serialized data to execute arbitrary code on the application's classpath. The threat is exacerbated by vulnerabilities in the mchange-commons-java dependency, which includes early JNDI implementations permitting remote factoryClassLocation values, enabling attackers to trigger remote code loading and execution through JNDI dereferencing. Starting with c3p0 0.12.0, the userOverridesAsString property uses a safe CSV-based format, and the dependency mchange-commons-java 0.4.0+ enforces restrictive configuration to block remote JNDI references. Additionally, c3p0 enforces the mchange-commons-java nameGuardClassName to prevent injection of unexpected JNDI names. There is no supported workaround for versions prior to 0.12.0, making upgrading essential to mitigate this vulnerability.
Potential Impact
Successful exploitation allows attackers with limited privileges (low privileges required) to execute arbitrary code on the application's classpath by exploiting unsafe deserialization and JNDI dereferencing. This can lead to complete compromise of the affected application environment. The vulnerability has a high CVSS 4.0 score of 8.9, reflecting high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fixed version of c3p0 is available starting from version 0.12.0, which replaces the vulnerable userOverridesAsString property format with a safe CSV-based format and depends on mchange-commons-java 0.4.0 or later that restricts remote JNDI references by default. Users should upgrade to c3p0 version 0.12.0 or later to remediate this vulnerability. There is no supported workaround for versions prior to 0.12.0. Review and apply vendor advisories and errata, such as those from Red Hat, for relevant patches and updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-24T02:32:39.800Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-27830","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:28385","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:4285","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3890","vendor":"Red Hat"}]
Threat ID: 699f9a40b7ef31ef0b7260eb
Added to database: 02/26/2026, 00:56:32 UTC
Last enriched: 07/15/2026, 08:44:54 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 147
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.