CVE-2026-55223— c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

可信数据的反序列化

swaldman c3p0 反序列化注入漏洞

swaldman c3p0是swaldman个人开发者的一款数据库连接池组件。 swaldman c3p0 0.14.0之前版本存在安全漏洞，该漏洞源于该库在反序列化时会自动解析JavaBean属性，且DataSource.getConnection()和ConnectionPoolDataSource.getPooledConnection()方法被JavaBean库错误地视为安全属性而实际调用JDBC驱动，使得攻击者可以构造恶意DataSource对象，当应用程序反序列化并自动解析bean属性时触发攻

N/A

N/A