c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8642-1 advisory.

    It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized     objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security     restrictions, or cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other
    libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection()
    and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat
    them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft
    malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in
    serialized form to where an application deserializes and auto-resolves bean properties — triggering the
    attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH,
    plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection
    paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that
    susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This
    issue has been fixed in version 0.14.0. (CVE-2026-55223)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other     libraries, can compose to a sink for deserialization gadgets. The JDBC spec's DataSource.getConnection()     and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat     them as properties assumed safe while they actually call into JDBC drivers. Attackers can thus craft     malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in     serialized form to where an application deserializes and auto-resolves bean properties  triggering the     attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH,     plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection     paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that     susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This     issue has been fixed in version 0.14.0. (CVE-2026-55223)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365425	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : c3p0 vulnerabilities (USN-8642-1)	Nessus	Ubuntu Local Security Checks	Local	high
463210	Echo: com.mchange:c3p0: security update to 0.14.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463210	Echo: com.mchange:c3p0: security update to 0.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445221	SCA: security update for com.mchange:c3p0 (GHSA-w6w4-rjh9-9r58)	Tenable Cloud Security	SCA Checks	Local	medium
445221	SCA: security update for com.mchange:c3p0 (GHSA-w6w4-rjh9-9r58)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
324707	Linux Distros Unpatched Vulnerability : CVE-2026-55223	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-55223

medium

Tenable Plugins

high

medium

medium

medium

medium

medium