CVE-2026-55223

Name of the Vulnerable Software and Affected Versions c3p0 versions prior to 0.14.0

Description c3p0, a JDBC Connection pooling library, can act as a sink for deserialization gadgets when used with other libraries. The DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() methods follow the getXXX() pattern, leading JavaBean libraries to treat them as safe properties. Attackers can create malicious DataSource objects that invoke vulnerable drivers during property lookups and send them in serialized form to an application that deserializes and auto-resolves bean properties. This process typically requires a susceptible DataSource or ConnectionPoolDataSource and a JDBC driver on the CLASSPATH, along with a carrier that auto-looks-up JavaBean properties upon deserialization, such as a collection using an Apache commons-beanutils Comparator for sorting by bean properties.

Recommendations Update to version 0.14.0.