cp30_XXE_partial_fix

c3p0 c3p0 is a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements. It is licensed under LGPL v.2.1 or EPL v.1.0, at your option. c3p0 is now maintained on github. c3p0 is available as managed dependency on Sonatype's open-source...

CVE-2021-36981

CVE-2021-36981 Verinice.Pro 1.22.1 Unsafe Java deserialization of untrusted data, leading to Remote Code Execution using C3P0 gadget authenticated PoC code to exploit the deserialization vulnerability. See...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

Astra Linux – Vulnerability in c3p0

C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...

c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

EUVD-2026-40847

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets...

GHSA-W6W4-RJH9-9R58 c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Impact The JDBC spec defines the interface DataSource, with a method called getConnection, and ConnectionPoolDataSource, with a method called getPooledConnection. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated,...

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Impact The JDBC spec defines the interface DataSource, with a method called getConnection, and ConnectionPoolDataSource, with a method called getPooledConnection. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated,...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances...

CVE-2026-55223

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

SUSE CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

CVE-2026-55153

A flaw was found in mchange-commons-java, a Java utility library. This vulnerability allows a remote attacker to achieve arbitrary code execution through Java Naming and Directory Interface JNDI injection. The library's JNDI ObjectFactory can construct objects of arbitrary classes and initialize...

Linux Distros Unpatched Vulnerability : CVE-2026-55223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a sink for deserialization...

c3p0-0.14.1-1.1 on GA media (moderate)

c3p0-0.14.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11166-1 Rating: moderate Cross-References: CVE-2026-55223 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the c3p0-0.14.1-1.1...

OPENSUSE-SU-2026:11166-1 c3p0-0.14.1-1.1 on GA media

These are all security issues fixed in the c3p0-0.14.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-55429

These are all security issues fixed in the c3p0-0.14.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

DEBIAN-CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

UBUNTU-CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...