Loading vulnerability…
Arbitrary Code Execution via Unsafe Deserialization in c3p0
CVE-2026-27830 is an unsafe deserialization vulnerability in c3p0 versions before 0.12.0. Several ConnectionPoolDataSource implementations store the writable userOverridesAsString JavaBean property as a hex-encoded Java-serialized object representing per-user configuration overrides. An attacker able to modify this property, directly or through crafted serialized objects or javax.naming.Reference instances, can trigger deserialization and execute unexpected code available on the application's classpath. Vulnerable mchange-commons-java dependencies amplify the issue by supporting JNDI references with unrestricted remote factoryClassLocation values, potentially enabling download and execution of attacker-controlled code. c3p0 0.12.0 replaces the serialized representation with a safe CSV-based format and introduces additional dependency and JNDI protections.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can execute arbitrary code with the privileges of the affected Java application, compromising its confidentiality, integrity, and availability. Depending on the available classes and dependency behavior, execution may use classpath-resident code or remotely downloaded malicious code. Security restriction bypass and denial of service are also possible.
If you can’t patch tonight, do this now.
No supported workaround exists for c3p0 versions before 0.12.0. On upgraded deployments, retain the restrictive mchange-commons-java defaults for remote factoryClassLocation values and c3p0's enforced JNDI name-guard protections.
Patch, then assume compromise.
Upgrade com.mchange:c3p0 to version 0.12.0 or later and ensure mchange-commons-java is version 0.4.0 or later. The fixed c3p0 implementation replaces Java object deserialization for userOverridesAsString with CSV parsing, uses dependency defaults that restrict remote factoryClassLocation values, and enforces a JNDI name guard. For vendor-packaged applications or operating-system packages, install the applicable vendor security update or supported backported fix, including updated libc3p0-java packages on affected Ubuntu systems.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.