ubuntu-cve-2026-55223
Vulnerability from osv_ubuntu
Published
2026-06-30 23:17
Modified
2026-06-30 23:17
Summary
Details
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.
Severity
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-7",
"0.9.1.2-9",
"0.9.1.2-9+deb8u1build0.14.04.1",
"0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-9",
"0.9.1.2-9+deb8u1build0.16.04.1",
"0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-9+deb8u1ubuntu0.18.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-9+deb8u1ubuntu0.18.04.1?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-9",
"0.9.1.2-9+deb8u1build0.18.04.1",
"0.9.1.2-9+deb8u1ubuntu0.18.04.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu0.20.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-10ubuntu0.20.04.1?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-10",
"0.9.1.2-10ubuntu0.20.04.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-10ubuntu1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-10",
"0.9.1.2-10ubuntu1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu2"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-10ubuntu2?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-10ubuntu1",
"0.9.1.2-10ubuntu2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-10ubuntu2"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-10ubuntu2?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-10ubuntu2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libc3p0-java",
"binary_version": "0.9.1.2-11"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "c3p0",
"purl": "pkg:deb/ubuntu/c3p0@0.9.1.2-11?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.1.2-10ubuntu2",
"0.9.1.2-11"
]
}
],
"aliases": [],
"details": "c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a \"sink\" for deserialization gadgets. The JDBC spec\u0027s DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as \"properties\" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties \u2014 triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.",
"id": "UBUNTU-CVE-2026-55223",
"modified": "2026-06-30T23:17:00Z",
"published": "2026-06-30T23:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-55223"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55223"
},
{
"type": "REPORT",
"url": "https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27"
},
{
"type": "REPORT",
"url": "https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-55223"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…