Detections
Analytics

Echo: multiple c3p0 packages: security update to 0.12.0

high Tenable Self-Hosted Container Security Plugin ID 463544

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized
 objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations
 have a property called `userOverridesAsString` which conceptually represents a
 `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded
 serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or
 via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute
 unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified
 by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that
 mirrors early implementations of JNDI functionality, including ungated support for remote
 `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized
 objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects
 and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of
 malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites
 are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the
 format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces,
 represents a serious independent fragility. The `userOverridesAsString` property of c3p0
 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely
 upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-
 commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration
 parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java
 `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI
 names. There is no supported workaround for versions of c3p0 prior to 0.12.0. (CVE-2026-27830)

Solution

Update the c3p0 library and its related packages to version 0.12.0 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-27830

Plugin Details

Severity: High

ID: 463544

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.11

CVSS v2

Risk Factor: High

Base Score: 7.7

Temporal Score: 5.7

Vector: CVSS2#AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-27830

CVSS v3

Risk Factor: High

Base Score: 8

Temporal Score: 7

Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.9

Threat Score: 5.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 2/25/2026

Reference Information

CVE: CVE-2026-27830