high 8.0

CVE-2026-27830 json

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

published 2026-02-25 8 mo ago modified 2026-09-15 55 d ago also EUVD-2026-8786 , GHSA-5476-xc4j-rqcv

cvss: 8.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Patch / fix

fixed in 4 distros 3 links 1

maven com.mchange:c3p0 0.12.0
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:6.6.48-1.Final_redhat_00001.1.el8eap
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:6.6.48-1.Final_redhat_00001.1.el9eap
Red Hat Red Hat Satellite 6.18 for RHEL 9 0:4.6.6-1.el9sat

ubuntu red hat suse

c3p0 Ubuntu Pro 16.04 LTS 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2
c3p0 Ubuntu Pro 18.04 LTS 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
c3p0 Ubuntu Pro 20.04 LTS 0.9.1.2-10ubuntu0.20.04.1+esm1
c3p0 Ubuntu Pro 22.04 LTS 0.9.1.2-10ubuntu1+esm1
c3p0 Ubuntu Pro 24.04 LTS 0.9.1.2-10ubuntu2+esm1
c3p0 Ubuntu Pro 26.04 LTS 0.9.1.2-11ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-27830

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

candlepin satellite 6.18 4.6.6-1.el9sat
dynflow-utils satellite capsule 6.18, satellite 6.18 2.0.1-1.el9sat
candlepin-selinux satellite 6.18 4.6.6-1.el9sat
python3.12-pillow satellite capsule 6.18, satellite 6.18 12.1.1-1.el9pc
eap8-angus jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap
eap8-guava jboss enterprise application platform 8.1 33.0.0-3.jre_redhat_00004.1.el8eap
eap8-netty jboss enterprise application platform 8.1 4.1.132-1.Final_redhat_00001.1.el8eap
eap8-yasson jboss enterprise application platform 8.1 3.0.4-5.redhat_00007.1.el8eap

red hat advisories RHSA-2026:73976 RHSA-2026:73644 RHSA-2026:28385 RHSA-2026:18054 RHSA-2026:18055

c3p0 openSUSE Leap 15.6 0.9.5.5-150400.3.5.1
mchange-commons openSUSE Leap 15.6 0.2.20-150400.3.3.1

suse advisories SUSE-SU-2026:0855-1

github.com/swaldman/c3p0@e14cbd8 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27830 updated 2026-11-04 cvss 8.0

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

Red Hat build of Debezium 2 c3p0, hibernate-c3p0 Red Hat build of Debezium 3 hibernate-c3p0
affected: no fix available
Red Hat Fuse 7 c3p0 Red Hat JBoss Enterprise Application Platform 7 c3p0, hibernate-c3p0
affected: no fix planned “Will not fix”
Red Hat JBoss Enterprise Application Platform 8 c3p0 Red Hat Satellite 6 c3p0
affected: no fix available
Red Hat streams for Apache Kafka 2 c3p0
affected: no fix planned “Will not fix”
Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11
fixed: vendor fix RHSA-2026:3890
Red Hat Build of Debezium 3.2
fixed: vendor fix RHSA-2026:4285
Red Hat JBoss EAP 8.1 for RHEL 8 eap8-hibernate 6.6.48-1.Final_redhat_00001.1.el8eap, eap8-hibernate-core 6.6.48-1.Final_redhat_00001.1.el8eap, eap8-hibernate-envers 6.6.48-1.Final_redhat_00001.1.el8eap
fixed: vendor fix RHSA-2026:18054
Red Hat JBoss EAP 8.1 for RHEL 9 eap8-hibernate 6.6.48-1.Final_redhat_00001.1.el9eap, eap8-hibernate-core 6.6.48-1.Final_redhat_00001.1.el9eap, eap8-hibernate-envers 6.6.48-1.Final_redhat_00001.1.el9eap
fixed: vendor fix RHSA-2026:18055

show 10 more

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.16-1.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-4.Final_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-netty-all 4.1.63-4.Final_redhat_00005.1.ep7.el7, eap7-wildfly-modules 7.1.16-1.GA_redhat_00002.1.ep7.el7, eap7-hibernate-core 5.1.17-5.Final_redhat_00006.1.ep7.el7, +4 more
fixed: vendor fix RHSA-2026:73976
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.19-1.GA_redhat_00004.1.el7eap, eap7-netty 4.1.63-7.Final_redhat_00005.1.el7eap, eap7-hibernate 5.3.39-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-7.Final_redhat_00005.1.el7eap, eap7-wildfly-modules 7.3.19-1.GA_redhat_00004.1.el7eap, eap7-wildfly-javadocs 7.3.19-1.GA_redhat_00004.1.el7eap, +28 more
fixed: vendor fix RHSA-2026:73644
Red Hat JBoss Enterprise Application Platform 8.1.6.GA hibernate-core 6.6.48.Final-redhat-00001
fixed: vendor fix RHSA-2026:18059
Red Hat Satellite 6.18 for RHEL 9 candlepin 4.6.6-1.el9sat, candlepin-selinux 4.6.6-1.el9sat
fixed: vendor fix RHSA-2026:28385
Red Hat build of Apache Camel - HawtIO 4 c3p0
not affected: vulnerable code not in execute path
Red Hat JBoss EAP 8.1 for RHEL 8 eap8-angus 2.0.5-1.redhat_00001.1.el8eap, eap8-yasson 3.0.4-5.redhat_00007.1.el8eap, eap8-jctools 4.0.6-1.redhat_00001.1.el8eap, eap8-angus-mail 2.0.5-1.redhat_00001.1.el8eap, eap8-guava 33.0.0-3.jre_redhat_00004.1.el8eap, eap8-wildfly 8.1.6-5.GA_redhat_00007.1.el8eap, +74 more Red Hat JBoss EAP 8.1 for RHEL 9 eap8-angus 2.0.5-1.redhat_00001.1.el9eap, eap8-yasson 3.0.4-5.redhat_00007.1.el9eap, eap8-jctools 4.0.6-1.redhat_00001.1.el9eap, eap8-angus-mail 2.0.5-1.redhat_00001.1.el9eap, eap8-guava 33.0.0-3.jre_redhat_00004.1.el9eap, eap8-wildfly 8.1.6-5.GA_redhat_00007.1.el9eap, +74 more Red Hat JBoss Enterprise Application Platform 8 c3p0, hibernate-c3p0, opentelemetry-c3p0-0.9, opentelemetry-javaagent-c3p0-0.9 Red Hat JBoss Enterprise Application Platform 8.1.6.GA bla.zip, pom.xml, aesh 2.4, c3 0.6.4, d3 7.4.3, he 1.2.0, +2269 more
not affected: vulnerable code not present
Red Hat JBoss Enterprise Application Platform Expansion Pack c3p0, hibernate-c3p0, opentelemetry-c3p0-0.9, opentelemetry-javaagent-c3p0-0.9
not affected: component not present
Red Hat Process Automation 7 c3p0
not affected: vulnerable code not present
Red Hat Satellite 6 hibernate-c3p0
not affected: component not present
Red Hat Satellite 6.18 for RHEL 9 satellite 6.18.6-1.el9sat, dynflow-utils 2.0.1-1.el9sat, python3.12-nh3 0.3.0-1.el9pc, satellite-cli 6.18.6-1.el9sat, python3.12-pillow 12.1.1-1.el9pc, satellite-common 6.18.6-1.el9sat, +9 more Red Hat streams for Apache Kafka 3 c3p0
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-05-02)

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.9	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADP	3.1	8.0	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	8.9	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	8.0	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	com.mchange:c3p0	<0.12.0	0.12.0

Affected products

swaldman c3p0
Red Hat Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11
Red Hat Red Hat Build of Debezium 3.2
Red Hat Red Hat JBoss Enterprise Application Platform 8.1
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
Red Hat Red Hat Satellite 6.18 for RHEL 9
Red Hat Red Hat build of Apache Camel - HawtIO 4
Red Hat Red Hat build of Debezium 2
Red Hat Red Hat build of Debezium 3
Red Hat Red Hat Fuse 7
Red Hat Red Hat JBoss Enterprise Application Platform 7
Red Hat Red Hat JBoss Enterprise Application Platform 8
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Red Hat Process Automation 7
Red Hat Red Hat Satellite 6
Red Hat streams for Apache Kafka 2
Red Hat streams for Apache Kafka 3

Classification

Weakness

CWE-502 Deserialization of Untrusted Data
CWE-94 Improper Control of Generation of Code

Technology feeds

Spring rss critical rss

References

github.com /swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e
web
access.redhat.com /errata/RHSA-2026:18054
vendor-advisory
access.redhat.com /errata/RHSA-2026:18055
vendor-advisory
access.redhat.com /errata/RHSA-2026:28385
vendor-advisory
access.redhat.com /errata/RHSA-2026:4285
vendor-advisory
access.redhat.com /errata/RHSA-2026:18059
vendor-advisory
access.redhat.com /errata/RHSA-2026:3890
vendor-advisory
github.com /swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv
web
mogwailabs.de /en/blog/2025/02/c3p0-you-little-rascal
web
mchange.com /projects/c3p0/#configuring_security
web
mchange.com /projects/c3p0/#security-note
web
access.redhat.com /security/cve/CVE-2026-27830
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=2442908
issue-tracking
security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-27830.json
nvd.nist.gov /vuln/detail/CVE-2026-27830
advisory
github.com /swaldman/c3p0
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary