CVE-2026-55223: CWE-502: Deserialization of Untrusted Data in swaldman c3p0
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.
AI Analysis
Technical Summary
The vulnerability in c3p0 (prior to version 0.14.0) involves unsafe deserialization of untrusted data due to the way JavaBean libraries treat DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() methods as safe properties. Attackers can exploit this by crafting malicious serialized DataSource objects that invoke vulnerable JDBC drivers during property lookups triggered by deserialization. This requires a susceptible DataSource/ConnectionPoolDataSource, a vulnerable JDBC driver on the classpath, and a deserialization context that auto-resolves bean properties, such as collections sorted by Apache commons-beanutils Comparator. The issue is resolved in c3p0 version 0.14.0.
Potential Impact
Successful exploitation allows attackers to execute deserialization gadgets via crafted DataSource objects, potentially leading to unauthorized code execution or other impacts associated with unsafe deserialization. The impact is limited by the need for specific conditions: vulnerable c3p0 version, presence of a susceptible JDBC driver, and a deserialization mechanism that auto-resolves bean properties.
Mitigation Recommendations
Upgrade c3p0 to version 0.14.0 or later, where this deserialization vulnerability is fixed. No other specific mitigations are indicated. Patch status is not explicitly stated as 'official-fix' but the fix is included in version 0.14.0. Users should verify they are running version 0.14.0 or newer to mitigate this issue.
CVE-2026-55223: CWE-502: Deserialization of Untrusted Data in swaldman c3p0
Description
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.
CVSS v4.0
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in c3p0 (prior to version 0.14.0) involves unsafe deserialization of untrusted data due to the way JavaBean libraries treat DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() methods as safe properties. Attackers can exploit this by crafting malicious serialized DataSource objects that invoke vulnerable JDBC drivers during property lookups triggered by deserialization. This requires a susceptible DataSource/ConnectionPoolDataSource, a vulnerable JDBC driver on the classpath, and a deserialization context that auto-resolves bean properties, such as collections sorted by Apache commons-beanutils Comparator. The issue is resolved in c3p0 version 0.14.0.
Potential Impact
Successful exploitation allows attackers to execute deserialization gadgets via crafted DataSource objects, potentially leading to unauthorized code execution or other impacts associated with unsafe deserialization. The impact is limited by the need for specific conditions: vulnerable c3p0 version, presence of a susceptible JDBC driver, and a deserialization mechanism that auto-resolves bean properties.
Mitigation Recommendations
Upgrade c3p0 to version 0.14.0 or later, where this deserialization vulnerability is fixed. No other specific mitigations are indicated. Patch status is not explicitly stated as 'official-fix' but the fix is included in version 0.14.0. Users should verify they are running version 0.14.0 or newer to mitigate this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T16:16:32.628Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a444c3a27e9c7971985d6bc
Added to database: 06/30/2026, 23:07:38 UTC
Last enriched: 07/08/2026, 12:49:25 UTC
Last updated: 08/14/2026, 00:41:13 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.