In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. (CVE-2026-55223)

The vulnerability in c3p0 prior to version 0.14.0 involves its DataSource and ConnectionPoolDataSource implementations being used as a deserialization gadget "sink". JavaBean libraries treat methods matching getXXX() as safe property accessors, but in this case, they invoke JDBC driver code during deserialization property resolution. Attackers can exploit this by crafting malicious serialized DataSource objects that, when deserialized in an environment with vulnerable JDBC drivers and auto-resolving bean properties (commonly via Apache commons-beanutils Comparator), trigger unsafe code execution paths. This requires the presence of c3p0's vulnerable DataSource, a susceptible JDBC driver on the classpath, and a deserialization context that auto-resolves bean properties. The vulnerability is addressed by upgrading to c3p0 version 0.14.0 or later.

Successful exploitation can lead to execution of attacker-controlled code paths during deserialization, potentially allowing privilege escalation or arbitrary code execution depending on the environment and JDBC driver vulnerabilities. The impact depends on the presence of vulnerable JDBC drivers and the application's deserialization behavior. The CVSS vector indicates network attack vector with low complexity and partial attack requirements, with low confidentiality, integrity, and availability impacts.

A fix is available by upgrading c3p0 to version 0.14.0 or later. Users should apply this official patch to remediate the vulnerability. No additional mitigation steps are specified beyond applying the update.