c3p0 vulnerabilities

1 known vulnerability in c3p0 from Swaldman. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  c3p0: Improper Control of Generation of Code

  CVE-2026-27830Feb 26, 2026Swaldman

  c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whic