CVE-2026-27830
Deserialization Vulnerability in c3p0 ConnectionPoolDataSource Enables RCE
Publication date: 2026-02-26
Last updated on: 2026-02-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| swaldman | c3p0 | to 0.12.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary and immediate mitigation step is to upgrade the c3p0 library to version 0.12.0 or later.'}, {'type': 'paragraph', 'content': 'Version 0.12.0 reimplements the userOverridesAsString property to use a safe CSV-based format instead of unsafe Java object deserialization, eliminating the attack surface.'}, {'type': 'paragraph', 'content': 'Additionally, ensure that the dependency mchange-commons-java is upgraded to version 0.4.0 or higher, which restricts remote factoryClassLocation usage by default and enforces name guarding to prevent injection of unexpected JNDI names.'}, {'type': 'paragraph', 'content': 'No supported workarounds exist for versions prior to 0.12.0, so upgrading is essential.'}, {'type': 'paragraph', 'content': "Review and harden your application's configuration to prevent unauthorized resets of the userOverridesAsString property."}] [1, 2]
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-27830 affects c3p0, a Java JDBC Connection pooling library, due to unsafe handling of the `userOverridesAsString` property in several `ConnectionPoolDataSource` implementations prior to version 0.12.0.'}, {'type': 'paragraph', 'content': "This property was stored as a hex-encoded serialized Java object, which allowed attackers who could reset this property—either on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances—to execute arbitrary code on the application's classpath."}, {'type': 'paragraph', 'content': "The risk is worsened by vulnerabilities in c3p0's dependency, `mchange-commons-java`, which supports early JNDI functionality with unrestricted remote `factoryClassLocation` values. Attackers could embed objects indirectly serialized through JNDI references, leading to deserialization and dereferencing of malicious `javax.naming.Reference` objects that trigger downloading and execution of malicious code from remote locations."}, {'type': 'paragraph', 'content': 'To fix this, c3p0 version 0.12.0 and later replaced the unsafe Java object deserialization with a safe CSV-based format for the `userOverridesAsString` property and depend on a secure version of `mchange-commons-java` that restricts remote code loading. There are no supported workarounds for versions prior to 0.12.0.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows attackers to execute arbitrary code remotely on the affected system without any user interaction.
Because the vulnerability enables remote code execution via deserialization of malicious objects, it poses a high risk to system confidentiality, integrity, and availability.
An attacker exploiting this flaw could compromise the application and potentially the underlying system, leading to unauthorized access, data breaches, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves identifying usage of vulnerable versions of the c3p0 library (prior to version 0.12.0) that handle the userOverridesAsString property as a hex-encoded serialized Java object.'}, {'type': 'paragraph', 'content': 'You can check your application dependencies or classpath for c3p0 versions below 0.12.0.'}, {'type': 'paragraph', 'content': 'Since the vulnerability involves deserialization of Java-serialized objects and JNDI references, monitoring for suspicious deserialization activity or unexpected resets of the userOverridesAsString property may help detect exploitation attempts.'}, {'type': 'paragraph', 'content': 'Suggested commands include:'}, {'type': 'list_item', 'content': 'Use dependency management tools to check c3p0 version, e.g., for Maven: mvn dependency:tree | grep c3p0'}, {'type': 'list_item', 'content': 'Search for c3p0 jar files and check their versions: find /path/to/application -name "c3p0*.jar" -exec jar xf {} META-INF/MANIFEST.MF \\; -exec grep \'Implementation-Version\' META-INF/MANIFEST.MF \\;'}, {'type': 'list_item', 'content': 'Monitor logs for deserialization errors or suspicious JNDI lookups related to javax.naming.Reference objects.'}, {'type': 'list_item', 'content': 'Use network monitoring tools to detect unusual outbound connections that may indicate remote code fetching triggered by exploitation.'}] [1]