CVE-2026-55223: Remote Code Execution via Deserialization Gadget Chain in c3p0 Connection Pooling Library

Vulnerability ID: CVE-2026-55223
CVSS Score: 6.3
Published: 2026-07-23

An untrusted deserialization vulnerability exists in the c3p0 JDBC connection pooling library before version 0.14.0. Standard JDBC getter methods conform to the JavaBean property getter pattern, allowing introspection libraries like Apache Commons BeanUtils to evaluate connection properties dynamically during deserialization, leading to arbitrary code execution when chained with a vulnerable database driver or JNDI sink.

TL;DR

c3p0 versions prior to 0.14.0 contain a deserialization gadget where JavaBean introspectors trigger getConnection() or getPooledConnection() on deserialized DataSources, leading to RCE via malicious JDBC URLs or JNDI lookups.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-502 / CWE-915
• Attack Vector: Network
• CVSS v4.0 Score: 6.3
• EPSS Score: 0.00284
• Exploit Status: Proof-of-Concept
• KEV Status: Not Listed

Affected Systems

• Java Enterprise Applications utilizing c3p0 and dynamic serialization frameworks like Apache Commons BeanUtils.
• c3p0: < 0.14.0 (Fixed in: 0.14.0)

Code Analysis

Commit: 7b022c4

Generate explicit BeanInfo descriptor classes that exclude dangerous connection and pooledConnection properties.

Mitigation Strategies

• Upgrade c3p0 library to version 0.14.0 or higher.
• Restrict Java Deserialization using look-ahead deserialization filters.
• Enforce strict network egress rules to prevent outbound connections to unapproved hosts.
• Harden Java runtime environment by disabling remote JNDI class loading.

Remediation Steps:

1. Identify all projects containing a dependency on com.mchange:c3p0 prior to version 0.14.0.
2. Modify dependency management configurations (Maven pom.xml or Gradle build.gradle) to enforce version 0.14.0.
3. Deploy runtime filters to intercept and block serialized objects containing c3p0 or Apache Commons BeanUtils descriptors.
4. Validate the update by scanning the compiled classpath using Software Composition Analysis tools.

References

• Official GitHub Advisory Record
• Official Fix Commit Patch Code
• c3p0 v0.14.0 Release Page
• NVD CVE Detail
• CVE Org Record

Read the full report for CVE-2026-55223 on our website for more details including interactive diagrams and full exploit analysis.