CVE-2026-55223 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties
Attackers can achieve remote code execution by smuggling malicious c3p0 DataSource objects into applications that deserialize and auto-resolve JavaBean properties.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55223?
CVE-2026-55223 is a medium-severity unsafe deserialization vulnerability in swaldman c3p0, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.
Which versions are affected by CVE-2026-55223?
2 open source packages ship an affected version, including com.mchange:c3p0.
| Package | Affected | Fixed in |
|---|---|---|
com.mchange:c3p0 Maven | All versions | 0.14.0 |
com.mchange:c3p0 Maven | All versions | 0.14.0 |
Linux distribution packages (1)
c3p0 openSUSE:Tumbleweed | All versions | 0.14.1-1.1 |
How do I fix CVE-2026-55223?
Upgrade com.mchange:c3p0 to 0.14.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-55223 being exploited?
There is no known exploitation of CVE-2026-55223 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JW54454, CLSA-2026-1786007625, CLSA-2026-1787905903, CLSA-2026-1793128010, DEBIAN-CVE-2026-55223, ECHO-613f-f20f-9845 and 3 more.