Every CVE Search/ Get API key

CVE-2026-27830

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

8.9 HighFix available

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.60%Up 0.5 points since Feb 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.9

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Record
CVE-2026-27830
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502, CWE-94, CWE-502
Updated
2026-11-02
EUVDEUVD-2026-8786 8.9

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Record
EUVD-2026-8786
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-5476-xc4j-rqcv 8.9

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Impact

c3p0 is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH.

The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation.

Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility.

Patches

The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization.

c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. Those parameters are documented here.

c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names.

Workarounds

Users should upgrade to c3p0-0.12.0 or above. There is no supported workaround for earlier versions of c3p0.

References

c3p0, you little rascal — Hans-Martin Münch c3p0 documentation, security note c3p0 documentation, configuring security

Record
GHSA-5476-xc4j-rqcv
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-94, CWE-502
Updated
2026-11-02
NVD 8.9

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Record
CVE-2026-27830
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-502
Updated
2026-11-02
OSV 8.9

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Record
CVE-2026-27830
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-502, CWE-94
Updated
2026-11-02
OSVDEBIAN-CVE-2026-27830 8.9

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Record
DEBIAN-CVE-2026-27830
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 17 moreShow less
OSVGHSA-5476-xc4j-rqcv 8.9

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Impact

c3p0 is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH.

The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation.

Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility.

Patches

The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization.

c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. Those parameters are documented here.

c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names.

Workarounds

Users should upgrade to c3p0-0.12.0 or above. There is no supported workaround for earlier versions of c3p0.

References

c3p0, you little rascal — Hans-Martin Münch c3p0 documentation, security note c3p0 documentation, configuring security

Record
GHSA-5476-xc4j-rqcv
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-502, CWE-94
Updated
2026-11-02
OSVOESA-2026-1691 8.9

c3p0 security update

c3p0 is a JDBC driver for extending traditional libraries (DriverManager-based libraries) with JNDI bindable data sources (including data sources), as described in the jdbc3 specification and jdbc2 standard extensions. They implement connections and statement pools.

Security Fix(es):

c3p0 is a JDBC connection pooling library. Prior to version 0.12.0, several ConnectionPoolDataSource implementations had a property called userOverridesAsString, which conceptually represents a Map&lt;String,Map&lt;String,String&gt;&gt; but was maintained as a hex-encoded Java serialized object. An attacker able to reset this property on an existing ConnectionPoolDataSource, or via maliciously crafted Java-serialized objects and javax.naming.Reference instances, could trigger deserialization. Combined with vulnerabilities in its main dependency, mchange-commons-java, which includes code mirroring early JNDI implementations with ungated support for remote factoryClassLocation values, attackers could set c3p0's userOverridesAsString to hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke the download and execution of malicious code from a remote factoryClassLocation, leading to arbitrary code execution on the application's CLASSPATH.(CVE-2026-27830)

Record
OESA-2026-1691
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:18054 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Record
RHSA-2026:18054
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:18055 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Record
RHSA-2026:18055
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:28385 8.0

Red Hat Security Advisory: Satellite 6.18.6 Async Update

Record
RHSA-2026:28385
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73644 8.3

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

Record
RHSA-2026:73644
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73976 8.3

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update

Record
RHSA-2026:73976
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27830 8.9

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map<String,Map<String,String>>. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing ConnectionPoolDataSource or via maliciously crafted serialized objects or javax.naming.Reference instances could be tailored execute unexpected code on the application's CLASSPATH. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote factoryClassLocation values. Attackers could set c3p0's userOverridesAsString hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded javax.naming.Reference objects could provoke download and execution of malicious code from a remote factoryClassLocation. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The userOverridesAsString property of c3p0 ConnectionPoolDataSource classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote factoryClassLocation values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java com.mchange.v2.naming.nameGuardClassName to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Record
UBUNTU-CVE-2026-27830
CVSS 4.0
8.9 HighCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1784077471 No score

TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.5-tuxcare.1.

Record
CLSA-2026-1784077471
Updated
2026-11-02
OSVCLSA-2026-1788527318 No score

TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3.

Record
CLSA-2026-1788527318
Updated
2026-11-02
OSVCLSA-2026-1789371869 No score

TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.1.

Record
CLSA-2026-1789371869
Updated
2026-11-02
OSVCLSA-2026-1789372000 No score

TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.2.1-tuxcare.1.

Record
CLSA-2026-1789372000
Updated
2026-11-02
OSVCLSA-2026-1789372028 No score

TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.3-tuxcare.1.

Record
CLSA-2026-1789372028
Updated
2026-11-02
OSVCLSA-2026-1793183878 No score

TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.4-tuxcare.5.

Record
CLSA-2026-1793183878
Updated
2026-11-02
OSVSUSE-SU-2026:0855-1 No score

Security update for c3p0 and mchange-commons

This update for c3p0 and mchange-commons fixes the following issues:

c3p0:

  • Security issues fixed:

    • CVE-2026-27830: Fixed unsafe object deserialization (bsc#1258942)

  • Fix the null pointer exception in the userOverridesAsString method (bsc#1259313).

mchange-commons:

  • Security issues fixed:

    • CVE-2026-27727: Disabled remote ClassLoading when dereferencing javax.naming.Reference instances (bsc#1258913)
Record
SUSE-SU-2026:0855-1
Updated
2026-11-02
OSVSUSE-SU-2026:1035-1 No score

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update

Record
SUSE-SU-2026:1035-1
Updated
2026-11-02
OSVUSN-8642-1 No score

c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service.

Record
USN-8642-1
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
com.mchange:c3p0
Maven
 before 0.12.0
0.12.0
com.mchange:c3p0
TuxCare:Maven
 0.9.5.5 up to 0.9.5.5-tuxcare.1
0.9.5.5-tuxcare.1
com.mchange:c3p0
TuxCare:Maven
 0.9.5.4 up to 0.9.5.4-tuxcare.3, plus listed versions
0.9.5.4-tuxcare.10.9.5.4-tuxcare.2
0.9.5.4-tuxcare.3
com.mchange:c3p0
TuxCare:Maven
From an advisory covering 2 CVEs
 0.9.5.2 up to 0.9.5.2-tuxcare.1
0.9.5.2-tuxcare.1
com.mchange:c3p0
TuxCare:Maven
 0.9.2.1 up to 0.9.2.1-tuxcare.1
0.9.2.1-tuxcare.1
com.mchange:c3p0
TuxCare:Maven
From an advisory covering 2 CVEs
 0.9.5.3 up to 0.9.5.3-tuxcare.1
0.9.5.3-tuxcare.1
com.mchange:c3p0
TuxCare:Maven
From an advisory covering 2 CVEs
 0.9.5.4 up to 0.9.5.4-tuxcare.5, plus listed versions
0.9.5.4-tuxcare.10.9.5.4-tuxcare.20.9.5.4-tuxcare.30.9.5.4-tuxcare.4
0.9.5.4-tuxcare.5
c3p0
Debian:12
 All versions, plus listed versions
0.9.1.2-100.9.1.2-10.10.9.1.2-10.1~deb12u10.9.1.2-11
 None known
c3p0
Debian:13
 All versions, plus listed versions
0.9.1.2-10.10.9.1.2-11
 None known
c3p0
Debian:14
 All versions, plus listed versions
0.9.1.2-10.10.9.1.2-11
 None known
Show 246 moreShow less
Affected packages
PackageAffectedFixed
com.mchange:c3p0
Maven
 before 0.12.0, plus listed versions
0.10.00.10.0-pre10.10.0-pre20.10.0-pre30.10.0-pre4
Show 35 moreShow less
0.10.0-pre50.10.0-pre60.10.0-pre70.10.10.10.20.11.00.11.0-pre10.11.0-pre20.11.10.11.20.9.20.9.2-pre2-RELEASE0.9.2-pre30.9.2-pre40.9.2-pre50.9.2-pre60.9.2-pre70.9.2-pre80.9.2.10.9.50.9.5-pre10.9.5-pre100.9.5-pre20.9.5-pre30.9.5-pre40.9.5-pre50.9.5-pre60.9.5-pre70.9.5-pre80.9.5-pre90.9.5.10.9.5.20.9.5.30.9.5.40.9.5.5
0.12.0
c3p0
openEuler:24.03-LTS-SP1
 before 0.9.5.4-4.oe2403sp1
0.9.5.4-4.oe2403sp1
c3p0
openEuler:24.03-LTS-SP2
 before 0.9.5.4-4.oe2403sp2
0.9.5.4-4.oe2403sp2
c3p0
openEuler:24.03-LTS-SP3
 before 0.9.5.4-4.oe2403sp3
0.9.5.4-4.oe2403sp3
c3p0
openEuler:20.03-LTS-SP4
 before 0.9.5.4-4.oe2003sp4
0.9.5.4-4.oe2003sp4
c3p0
openEuler:22.03-LTS-SP4
 before 0.9.5.4-4.oe2203sp4
0.9.5.4-4.oe2203sp4
c3p0
openEuler:24.03-LTS
 before 0.9.5.4-4.oe2403
0.9.5.4-4.oe2403
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-angus
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el8eap
0:2.0.5-1.redhat_00001.1.el8eap
eap8-angus-activation
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.3-1.redhat_00001.1.el8eap
0:2.0.3-1.redhat_00001.1.el8eap
eap8-angus-mail
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el8eap
0:2.0.5-1.redhat_00001.1.el8eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el8eap
0:801.6.0-1.GA_redhat_00001.1.el8eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el8eap
0:801.6.0-1.GA_redhat_00001.1.el8eap
eap8-guava
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el8eap
0:33.0.0-3.jre_redhat_00004.1.el8eap
eap8-guava-failureaccess
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.0.3-1.redhat_00001.1.el8eap
0:1.0.3-1.redhat_00001.1.el8eap
eap8-guava-libraries
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el8eap
0:33.0.0-3.jre_redhat_00004.1.el8eap
eap8-hal-console
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.7.19-1.Final_redhat_00001.1.el8eap
0:3.7.19-1.Final_redhat_00001.1.el8eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-backend-elasticsearch
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-backend-lucene
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-engine
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-mapper-orm
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-mapper-pojo-base
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-util-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-jakarta-activation
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.redhat_00001.1.el8eap
0:2.1.4-1.redhat_00001.1.el8eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.6.2-1.Final_redhat_00001.1.el8eap
0:3.6.2-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-appclient
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-ear
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-ejb
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-web
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el8eap
0:4.0.6-1.redhat_00001.1.el8eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el8eap
0:4.0.6-1.redhat_00001.1.el8eap
eap8-netty
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-buffer
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec-http
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-handler
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-resolver
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-native-epoll
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-native-epoll-debuginfo
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-plexus-utils
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.6.1-1.redhat_00001.1.el8eap
0:3.6.1-1.redhat_00001.1.el8eap
eap8-reactivex-rxjava
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.1.12-1.redhat_00001.1.el8eap
0:3.1.12-1.redhat_00001.1.el8eap
eap8-reactivex-rxjava2
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.2.21-5.redhat_00003.1.el8eap
0:2.2.21-5.redhat_00003.1.el8eap
eap8-wildfly-client-config
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.0.1-4.Final_redhat_00002.1.el8eap
0:1.0.1-4.Final_redhat_00002.1.el8eap
eap8-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.1-10.GA_redhat_00017.1.el8eap
0:8.1.1-10.GA_redhat_00017.1.el8eap
eap8-wildfly-openssl
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el8eap
0:2.3.0-1.Final_redhat_00001.1.el8eap
eap8-wildfly-openssl-el8-x86_64
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final.redhat.00001.1.el8eap
0:2.3.0-1.Final.redhat.00001.1.el8eap
eap8-wildfly-openssl-el8-x86_64-debuginfo
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final.redhat.00001.1.el8eap
0:2.3.0-1.Final.redhat.00001.1.el8eap
eap8-wildfly-openssl-java
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el8eap
0:2.3.0-1.Final_redhat_00001.1.el8eap
eap8-yasson
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.0.4-5.redhat_00007.1.el8eap
0:3.0.4-5.redhat_00007.1.el8eap
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-angus
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el9eap
0:2.0.5-1.redhat_00001.1.el9eap
eap8-angus-activation
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.0.3-1.redhat_00001.1.el9eap
0:2.0.3-1.redhat_00001.1.el9eap
eap8-angus-mail
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el9eap
0:2.0.5-1.redhat_00001.1.el9eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el9eap
0:801.6.0-1.GA_redhat_00001.1.el9eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el9eap
0:801.6.0-1.GA_redhat_00001.1.el9eap
eap8-guava
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el9eap
0:33.0.0-3.jre_redhat_00004.1.el9eap
eap8-guava-failureaccess
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.0.3-1.redhat_00001.1.el9eap
0:1.0.3-1.redhat_00001.1.el9eap
eap8-guava-libraries
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el9eap
0:33.0.0-3.jre_redhat_00004.1.el9eap
eap8-hal-console
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.7.19-1.Final_redhat_00001.1.el9eap
0:3.7.19-1.Final_redhat_00001.1.el9eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el9eap
0:6.6.48-1.Final_redhat_00001.1.el9eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el9eap
0:6.6.48-1.Final_redhat_00001.1.el9eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el9eap
0:6.6.48-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-backend-elasticsearch
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-backend-lucene
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-engine
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-mapper-orm
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-mapper-pojo-base
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-util-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-jakarta-activation
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.redhat_00001.1.el9eap
0:2.1.4-1.redhat_00001.1.el9eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.6.2-1.Final_redhat_00001.1.el9eap
0:3.6.2-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-appclient
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-ear
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-ejb
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-web
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el9eap
0:4.0.6-1.redhat_00001.1.el9eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el9eap
0:4.0.6-1.redhat_00001.1.el9eap
eap8-netty
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-buffer
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec-http
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-handler
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-resolver
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-transport
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-transport-native-epoll
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-transport-native-epoll-debuginfo
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-plexus-utils
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.6.1-1.redhat_00001.1.el9eap
0:3.6.1-1.redhat_00001.1.el9eap
eap8-reactivex-rxjava
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.1.12-1.redhat_00001.1.el9eap
0:3.1.12-1.redhat_00001.1.el9eap
eap8-reactivex-rxjava2
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.2.21-5.redhat_00003.1.el9eap
0:2.2.21-5.redhat_00003.1.el9eap
eap8-wildfly-client-config
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.0.1-4.Final_redhat_00002.1.el9eap
0:1.0.1-4.Final_redhat_00002.1.el9eap
eap8-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el9eap
0:2.1.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el9eap
0:2.1.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el9eap
0:2.1.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el9eap
0:2.1.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el9eap
0:2.1.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.1-10.GA_redhat_00017.1.el9eap
0:8.1.1-10.GA_redhat_00017.1.el9eap
eap8-wildfly-openssl
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el9eap
0:2.3.0-1.Final_redhat_00001.1.el9eap
eap8-wildfly-openssl-el9-x86_64
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el9eap
0:2.3.0-1.Final_redhat_00001.1.el9eap
eap8-wildfly-openssl-el9-x86_64-debuginfo
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el9eap
0:2.3.0-1.Final_redhat_00001.1.el9eap
eap8-wildfly-openssl-java
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el9eap
0:2.3.0-1.Final_redhat_00001.1.el9eap
eap8-yasson
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.0.4-5.redhat_00007.1.el9eap
0:3.0.4-5.redhat_00007.1.el9eap
python3.12-pillow
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
candlepin
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:4.6.6-1.el9sat
0:4.6.6-1.el9sat
candlepin-selinux
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:4.6.6-1.el9sat
0:4.6.6-1.el9sat
dynflow-utils
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:2.0.1-1.el9sat
0:2.0.1-1.el9sat
dynflow-utils
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:2.0.1-1.el9sat
0:2.0.1-1.el9sat
eap7-hibernate
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:5.3.39-1.Final_redhat_00001.1.el7eap
0:5.3.39-1.Final_redhat_00001.1.el7eap
eap7-hibernate-core
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:5.3.39-1.Final_redhat_00001.1.el7eap
0:5.3.39-1.Final_redhat_00001.1.el7eap
eap7-hibernate-entitymanager
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:5.3.39-1.Final_redhat_00001.1.el7eap
0:5.3.39-1.Final_redhat_00001.1.el7eap
eap7-hibernate-envers
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:5.3.39-1.Final_redhat_00001.1.el7eap
0:5.3.39-1.Final_redhat_00001.1.el7eap
eap7-hibernate-java8
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:5.3.39-1.Final_redhat_00001.1.el7eap
0:5.3.39-1.Final_redhat_00001.1.el7eap
eap7-jboss-server-migration
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-cli
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-core
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap6.4
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap6.4-to-eap7.3
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap7.0
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap7.1
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap7.2
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap7.2-to-eap7.3
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-eap7.3-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly10.0
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly10.1
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly11.0
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly12.0
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly13.0-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly14.0-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly15.0-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly16.0-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly17.0-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly18.0-server
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly8.2
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-jboss-server-migration-wildfly9.0
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:1.7.2-24.Final_redhat_00026.1.el7eap
0:1.7.2-24.Final_redhat_00026.1.el7eap
eap7-netty
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:4.1.63-7.Final_redhat_00005.1.el7eap
0:4.1.63-7.Final_redhat_00005.1.el7eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:4.1.63-7.Final_redhat_00005.1.el7eap
0:4.1.63-7.Final_redhat_00005.1.el7eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:7.3.19-1.GA_redhat_00004.1.el7eap
0:7.3.19-1.GA_redhat_00004.1.el7eap
eap7-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:7.3.19-1.GA_redhat_00004.1.el7eap
0:7.3.19-1.GA_redhat_00004.1.el7eap
eap7-wildfly-java-jdk8
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:7.3.19-1.GA_redhat_00004.1.el7eap
0:7.3.19-1.GA_redhat_00004.1.el7eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:7.3.19-1.GA_redhat_00004.1.el7eap
0:7.3.19-1.GA_redhat_00004.1.el7eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform_eus:7.3::el7
From an advisory covering 7 CVEs
 before 0:7.3.19-1.GA_redhat_00004.1.el7eap
0:7.3.19-1.GA_redhat_00004.1.el7eap
eap7-hibernate
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:5.1.17-5.Final_redhat_00006.1.ep7.el7
0:5.1.17-5.Final_redhat_00006.1.ep7.el7
eap7-hibernate-core
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:5.1.17-5.Final_redhat_00006.1.ep7.el7
0:5.1.17-5.Final_redhat_00006.1.ep7.el7
eap7-hibernate-entitymanager
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:5.1.17-5.Final_redhat_00006.1.ep7.el7
0:5.1.17-5.Final_redhat_00006.1.ep7.el7
eap7-hibernate-envers
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:5.1.17-5.Final_redhat_00006.1.ep7.el7
0:5.1.17-5.Final_redhat_00006.1.ep7.el7
eap7-hibernate-infinispan
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:5.1.17-5.Final_redhat_00006.1.ep7.el7
0:5.1.17-5.Final_redhat_00006.1.ep7.el7
eap7-hibernate-java8
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:5.1.17-5.Final_redhat_00006.1.ep7.el7
0:5.1.17-5.Final_redhat_00006.1.ep7.el7
eap7-netty
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:4.1.63-4.Final_redhat_00005.1.ep7.el7
0:4.1.63-4.Final_redhat_00005.1.ep7.el7
eap7-netty-all
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:4.1.63-4.Final_redhat_00005.1.ep7.el7
0:4.1.63-4.Final_redhat_00005.1.ep7.el7
eap7-wildfly
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:7.1.16-1.GA_redhat_00002.1.ep7.el7
0:7.1.16-1.GA_redhat_00002.1.ep7.el7
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform_eus:7.1::el7
From an advisory covering 7 CVEs
 before 0:7.1.16-1.GA_redhat_00002.1.ep7.el7
0:7.1.16-1.GA_redhat_00002.1.ep7.el7
c3p0
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 0.9.5.5-150400.3.5.1
0.9.5.5-150400.3.5.1
mchange-commons
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 0.2.20-150400.3.3.1
0.2.20-150400.3.3.1
c3p0
Ubuntu:Pro:16.04:LTS
 before 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2, plus listed versions
0.9.1.2-90.9.1.2-9+deb8u1build0.16.04.10.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1
0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2
c3p0
Ubuntu:Pro:18.04:LTS
 before 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1, plus listed versions
0.9.1.2-90.9.1.2-9+deb8u1build0.18.04.10.9.1.2-9+deb8u1ubuntu0.18.04.1
0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
c3p0
Ubuntu:Pro:20.04:LTS
 before 0.9.1.2-10ubuntu0.20.04.1+esm1, plus listed versions
0.9.1.2-100.9.1.2-10ubuntu0.20.04.1
0.9.1.2-10ubuntu0.20.04.1+esm1
c3p0
Ubuntu:Pro:22.04:LTS
 before 0.9.1.2-10ubuntu1+esm1, plus listed versions
0.9.1.2-100.9.1.2-10ubuntu1
0.9.1.2-10ubuntu1+esm1
c3p0
Ubuntu:Pro:24.04:LTS
 before 0.9.1.2-10ubuntu2+esm1, plus listed versions
0.9.1.2-10ubuntu10.9.1.2-10ubuntu2
0.9.1.2-10ubuntu2+esm1
c3p0
Ubuntu:25.10
 All versions, plus listed versions
0.9.1.2-10ubuntu2
 None known
c3p0
Ubuntu:26.10
 All versions, plus listed versions
0.9.1.2-11
 None known
c3p0
Ubuntu:Pro:26.04:LTS
 before 0.9.1.2-11ubuntu0.1~esm1, plus listed versions
0.9.1.2-10ubuntu20.9.1.2-11
0.9.1.2-11ubuntu0.1~esm1
c3p0
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1, plus listed versions
0.9.1.2-90.9.1.2-9+deb8u1build0.18.04.10.9.1.2-9+deb8u1ubuntu0.18.04.1
0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
c3p0
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 0.9.1.2-10ubuntu0.20.04.1+esm1, plus listed versions
0.9.1.2-100.9.1.2-10ubuntu0.20.04.1
0.9.1.2-10ubuntu0.20.04.1+esm1
c3p0
Ubuntu:Pro:22.04:LTS
From an advisory covering 4 CVEs
 before 0.9.1.2-10ubuntu1+esm1, plus listed versions
0.9.1.2-100.9.1.2-10ubuntu1
0.9.1.2-10ubuntu1+esm1
c3p0
Ubuntu:Pro:24.04:LTS
From an advisory covering 4 CVEs
 before 0.9.1.2-10ubuntu2+esm1, plus listed versions
0.9.1.2-10ubuntu10.9.1.2-10ubuntu2
0.9.1.2-10ubuntu2+esm1
c3p0
Ubuntu:Pro:26.04:LTS
From an advisory covering 4 CVEs
 before 0.9.1.2-11ubuntu0.1~esm1, plus listed versions
0.9.1.2-10ubuntu20.9.1.2-11
0.9.1.2-11ubuntu0.1~esm1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27830 is a high vulnerability (CVSS 8.9) in Swaldman C3p0, published February 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in com.mchange:c3p0 0.12.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 56 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open