Vulnerabilities

TI-2026-39844 CVE-2026-55153 · GHSA-h84g-69h7-mw6v

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

LOW 33

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool.

CVSS 3.1HIGH 7.1 Adjacent network Low privileges No interaction EPSS 0.00194 Published 2026-07-01 Partial fix · 0.6.0 CWE-470

TI-2026-39900 CVE-2026-55223 · GHSA-w6w4-rjh9-9r58

c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

LOW 35

c3p0 is a JDBC Connection pooling library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0048 Published 2026-06-30 Partial fix · 0.14.0 CWE-502

TI-2026-22181 CVE-2026-27830 · GHSA-5476-xc4j-rqcv

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

MEDIUM 41

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances.

CVSS 4.0HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.00595 Published 2026-02-26 Partial fix · 0.12.0 CWE-502

Vulnerabilities

Filters

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property