CVE-2026-55223: c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

The JDBC spec defines the interface DataSource, with a method called getConnection(), and ConnectionPoolDataSource, with a method called getPooledConnection(). These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated, flexible tools which may be, and in practice sometimes have proven to be, susceptible to abuse.

Unfortunately, the JavaBean framework treats methods of this form, getXXX(), as JavaBean “properties”, which JavaBean-related libraries often presume represent quick, safe-to-look-up, state or configuration.

Attackers therefore can construct malicious DataSource objects — objects whose calls to getConnection() or getPooledConnection() would trigger attacks via vulnerable JDBC drivers — and bundle them in contexts that automatically look up bean properties on deserialization. If an attacker can smuggle such an object in serialized form to a location from which an application will deserialize it, an attack is triggered.

It’s not easy. It requires that a susceptible JDBC DataSource or ConnectionPoolDataSource be available on the application CLASSPATH, along with a susceptible JDBC driver, and a carrier that will automatically look up JavaBean properties on deserialization. In practice, the most common such carrier is the composition of a collection and a Comparator implementation that sorts based on JavaBean properties from Apache commons-beanutils.

But c3p0 prior to 0.14.0 offered the susceptible JDBC DataSource or ConnectionPoolDataSource, supplying an essential component of the trigger.