c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.

ubuntu_linux USN-8642-1: Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS : c3p0 vulnerabilities (USN-8642-1)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other
    libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection()
    and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat
    them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft
    malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in
    serialized form to where an application deserializes and auto-resolves bean properties — triggering the
    attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH,
    plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection
    paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that
    susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This
    issue has been fixed in version 0.14.0. (CVE-2026-55223)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other     libraries, can compose to a sink for deserialization gadgets. The JDBC spec's DataSource.getConnection()     and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat     them as properties assumed safe while they actually call into JDBC drivers. Attackers can thus craft     malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in     serialized form to where an application deserializes and auto-resolves bean properties  triggering the     attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH,     plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection     paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that     susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This     issue has been fixed in version 0.14.0. (CVE-2026-55223)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463210	Echo: com.mchange:c3p0: security update to 0.14.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463210	Echo: com.mchange:c3p0: security update to 0.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445221	SCA: security update for com.mchange:c3p0 (GHSA-w6w4-rjh9-9r58)	Tenable Cloud Security	SCA Checks	Local	medium
445221	SCA: security update for com.mchange:c3p0 (GHSA-w6w4-rjh9-9r58)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
324707	Linux Distros Unpatched Vulnerability : CVE-2026-55223	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-55223

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium