Detections
Analytics

SCA: security update for com.mchange:c3p0 (GHSA-5476-xc4j-rqcv)

high Tenable Self-Hosted Container Security Plugin ID 437985

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized
 objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations
 have a property called `userOverridesAsString` which conceptually represents a
 `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded
 serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or
 via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute
 unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified
 by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that
 mirrors early implementations of JNDI functionality, including ungated support for remote
 `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized
 objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects
 and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of
 malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites
 are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the
 format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces,
 represents a serious independent fragility. The `userOverridesAsString` property of c3p0
 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely
 upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-
 commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration
 parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java
 `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI
 names. There is no supported workaround for versions of c3p0 prior to 0.12.0. (CVE-2026-27830)

See Also

https://github.com/advisories/GHSA-5476-xc4j-rqcv

Plugin Details

Severity: High

ID: 437985

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 2/26/2026

Updated: 7/15/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.11

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-27830

CVSS v3

Risk Factor: High

Base Score: 8

Temporal Score: 7

Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.9

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/25/2026

Vulnerability Publication Date: 2/25/2026

Reference Information

CVE: CVE-2026-27830