c3p0 vulnérable à l'exécution de code à distance via une désérialisation non sécurisée de la propriété userOverridesAsString

The impact of CVE-2026-27830 is severe, enabling an attacker to execute arbitrary code on the server hosting the application utilizing the vulnerable c3p0 library. Successful exploitation could lead to complete system compromise, including data exfiltration, privilege escalation, and denial of service. The vulnerability stems from the insecure handling of serialized objects within the userOverridesAsString property, allowing attackers to inject malicious code disguised as configuration data. This is analogous to vulnerabilities where deserialization flaws are leveraged to achieve RCE, potentially allowing attackers to bypass security controls and gain unauthorized access.

Applications utilizing c3p0 for database connection pooling, particularly those handling external configuration data or user input that influences connection pool settings, are at risk. Systems with older, unpatched c3p0 installations are especially vulnerable. Shared hosting environments where multiple applications share the same c3p0 instance could also be affected, as a compromise in one application could potentially impact others.

• java / server:

# Check c3p0 version
java -version
# Inspect application logs for suspicious connection pool configuration changes
# Use a security scanner to identify vulnerable applications using c3p0

• generic web:

# Check for unusual serialized object data in request parameters or headers
# Monitor application logs for errors related to deserialization

1. 2026-02-26Disclosure

   disclosure

1. Réservé2026-02-24
2. Publiée2026-02-26
3. Modifiée2026-05-04
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-27830 is to upgrade to c3p0 version 0.12.0 or later, which addresses the vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Carefully review and sanitize any external data used to configure the userOverridesAsString property. Implement strict input validation and consider using a Web Application Firewall (WAF) to filter potentially malicious serialized objects. Monitor application logs for suspicious activity related to connection pool configuration changes. After upgrading, confirm the fix by attempting to create a ConnectionPoolDataSource with a malicious serialized object and verifying that it fails to execute.