cp30_XXE_partial_fix

c3p0 c3p0 is a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements. It is licensed under LGPL v.2.1 or EPL v.1.0, at your option. c3p0 is now maintained on github. c3p0 is available as managed dependency on Sonatype's open-source...

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.19 Update (Important) (RHSA-2026:73644)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73644 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.16 (RHSA-2026:73976)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73976 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

CVE-2021-36981

CVE-2021-36981 Verinice.Pro 1.22.1 Unsafe Java deserialization of untrusted data, leading to Remote Code Execution using C3P0 gadget authenticated PoC code to exploit the deserialization vulnerability. See...

Astra Linux – Vulnerability in c3p0

C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...

CLSA-2026-1789372028 TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.3-tuxcare.1...

CLSA-2026-1789372000 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.2.1-tuxcare.1...

CLSA-2026-1789371869 TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.1...

CLSA-2026-1788527318 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLSA-2026-1787905903 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.1...

USN-8642-1 c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...

USN-8642-1: c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...

c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

CLSA-2026-1786007625 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.5-tuxcare.3...

CLSA-2026-1784077471 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.5-tuxcare.1...

The vulnerability of the userOverridesAsString method in the JDBC driver library allows a hacker to execute arbitrary code.

The vulnerability of the userOverridesAsString method in the JDBC driver handling library in c3p0 is related to incorrect code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created Java serializable objects and instances of...