OESA-2026-1691 (CVE-2026-27830)

Vulnerability from osv_openeuler – Published: 2026-03-20 11:10 – Updated: 2026-08-06 11:10 – Source website
VLAI
Summary
c3p0 security update
Details

c3p0 is a JDBC driver for extending traditional libraries (DriverManager-based libraries) with JNDI bindable data sources (including data sources), as described in the jdbc3 specification and jdbc2 standard extensions. They implement connections and statement pools.

Security Fix(es):

c3p0 is a JDBC connection pooling library. Prior to version 0.12.0, several ConnectionPoolDataSource implementations had a property called userOverridesAsString, which conceptually represents a Map<String,Map<String,String>> but was maintained as a hex-encoded Java serialized object. An attacker able to reset this property on an existing ConnectionPoolDataSource, or via maliciously crafted Java-serialized objects and javax.naming.Reference instances, could trigger deserialization. Combined with vulnerabilities in its main dependency, mchange-commons-java, which includes code mirroring early JNDI implementations with ungated support for remote factoryClassLocation values, attackers could set c3p0's userOverridesAsString to hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke the download and execution of malicious code from a remote factoryClassLocation, leading to arbitrary code execution on the application's CLASSPATH.(CVE-2026-27830)

Severity
8.9 (High)
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "c3p0-0.9.5.4-4.oe2403sp1.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "c3p0-0.9.5.4-4.oe2403sp1.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "c3p0",
        "purl": "pkg:rpm/openEuler/c3p0\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5.4-4.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "c3p0-0.9.5.4-4.oe2403sp2.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "c3p0-0.9.5.4-4.oe2403sp2.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "c3p0",
        "purl": "pkg:rpm/openEuler/c3p0\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5.4-4.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "c3p0-0.9.5.4-4.oe2403sp3.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "c3p0-0.9.5.4-4.oe2403sp3.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "c3p0",
        "purl": "pkg:rpm/openEuler/c3p0\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5.4-4.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "c3p0-0.9.5.4-4.oe2003sp4.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "c3p0-0.9.5.4-4.oe2003sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "c3p0",
        "purl": "pkg:rpm/openEuler/c3p0\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5.4-4.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "c3p0-0.9.5.4-4.oe2203sp4.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "c3p0-0.9.5.4-4.oe2203sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "c3p0",
        "purl": "pkg:rpm/openEuler/c3p0\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5.4-4.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "c3p0-0.9.5.4-4.oe2403sp1.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403sp1.noarch.rpm",
          "c3p0-0.9.5.4-4.oe2403sp2.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403sp2.noarch.rpm",
          "c3p0-0.9.5.4-4.oe2403sp3.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403sp3.noarch.rpm",
          "c3p0-0.9.5.4-4.oe2403.noarch.rpm",
          "c3p0-help-0.9.5.4-4.oe2403.noarch.rpm"
        ],
        "src": [
          "c3p0-0.9.5.4-4.oe2403sp1.src.rpm",
          "c3p0-0.9.5.4-4.oe2403sp2.src.rpm",
          "c3p0-0.9.5.4-4.oe2403sp3.src.rpm",
          "c3p0-0.9.5.4-4.oe2403.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "c3p0",
        "purl": "pkg:rpm/openEuler/c3p0\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5.4-4.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "c3p0 is a JDBC driver for extending traditional libraries (DriverManager-based libraries) with JNDI bindable data sources (including data sources), as described in the jdbc3 specification and jdbc2 standard extensions. They implement connections and statement pools.\r\n\r\nSecurity Fix(es):\n\nc3p0 is a JDBC connection pooling library. Prior to version 0.12.0, several `ConnectionPoolDataSource` implementations had a property called `userOverridesAsString`, which conceptually represents a `Map\u0026lt;String,Map\u0026lt;String,String\u0026gt;\u0026gt;` but was maintained as a hex-encoded Java serialized object. An attacker able to reset this property on an existing `ConnectionPoolDataSource`, or via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances, could trigger deserialization. Combined with vulnerabilities in its main dependency, mchange-commons-java, which includes code mirroring early JNDI implementations with ungated support for remote `factoryClassLocation` values, attackers could set c3p0\u0026apos;s `userOverridesAsString` to hex-encoded serialized objects that include objects \u0026quot;indirectly serialized\u0026quot; via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke the download and execution of malicious code from a remote `factoryClassLocation`, leading to arbitrary code execution on the application\u0026apos;s `CLASSPATH`.(CVE-2026-27830)",
  "id": "OESA-2026-1691",
  "modified": "2026-08-06T11:10:43Z",
  "published": "2026-03-20T11:10:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1691"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27830"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "c3p0 security update",
  "upstream": [
    "CVE-2026-27830"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.