{"id":"CVE-2026-27830","aliases":["CLSA-2026-1784077471","CLSA-2026-1788527318","CLSA-2026-1789371869","CLSA-2026-1789372000","CLSA-2026-1789372028","CLSA-2026-1793183878","DEBIAN-CVE-2026-27830","EUVD-2026-8786","GHSA-5476-xc4j-rqcv","OESA-2026-1691","RHSA-2026:18054","RHSA-2026:18055","RHSA-2026:28385","RHSA-2026:73644","RHSA-2026:73976","SUSE-SU-2026:0855-1","SUSE-SU-2026:1035-1","UBUNTU-CVE-2026-27830","USN-8642-1"],"status":"published","title":"c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00595,"percentile":0.48915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-94"],"published":"2026-02-25T18:35:23Z","modified":"2026-10-28T13:45:03Z","fixes":[{"ecosystem":"Maven","package":"com.mchange:c3p0","fixed_in":["0.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","fixed_in":["0.9.5.5-tuxcare.1","0.9.5.4-tuxcare.3","0.9.2.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"c3p0","fixed_in":["0.9.5.4-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"c3p0","fixed_in":["0.9.5.4-4.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"c3p0","fixed_in":["0.9.5.4-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"c3p0","fixed_in":["0.9.5.4-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"c3p0","fixed_in":["0.9.5.4-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"c3p0","fixed_in":["0.9.5.4-4.oe2403"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-10ubuntu0.20.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-10ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-10ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-11ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5.5"},{"fixed":"0.9.5.5-tuxcare.1"}]}],"versions":["0.9.5.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5.4"},{"fixed":"0.9.5.4-tuxcare.3"}]}],"versions":["0.9.5.4","0.9.5.4-tuxcare.1","0.9.5.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5.2"},{"fixed":"0.9.5.2-tuxcare.1"}]}],"versions":["0.9.5.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.2.1"},{"fixed":"0.9.2.1-tuxcare.1"}]}],"versions":["0.9.2.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5.3"},{"fixed":"0.9.5.3-tuxcare.1"}]}],"versions":["0.9.5.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5.4"},{"fixed":"0.9.5.4-tuxcare.5"}]}],"versions":["0.9.5.4","0.9.5.4-tuxcare.1","0.9.5.4-tuxcare.2","0.9.5.4-tuxcare.3","0.9.5.4-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-10","0.9.1.2-10.1","0.9.1.2-10.1~deb12u1","0.9.1.2-11"]},{"source":"osv","ecosystem":"Debian:13","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-10.1","0.9.1.2-11"]},{"source":"osv","ecosystem":"Debian:14","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-10.1","0.9.1.2-11"]},{"source":"osv","ecosystem":"Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0"}]}],"versions":["0.10.0","0.10.0-pre1","0.10.0-pre2","0.10.0-pre3","0.10.0-pre4","0.10.0-pre5","0.10.0-pre6","0.10.0-pre7","0.10.1","0.10.2","0.11.0","0.11.0-pre1","0.11.0-pre2","0.11.1","0.11.2","0.9.2","0.9.2-pre2-RELEASE","0.9.2-pre3","0.9.2-pre4","0.9.2-pre5","0.9.2-pre6","0.9.2-pre7","0.9.2-pre8","0.9.2.1","0.9.5","0.9.5-pre1","0.9.5-pre10","0.9.5-pre2","0.9.5-pre3","0.9.5-pre4","0.9.5-pre5","0.9.5-pre6","0.9.5-pre7","0.9.5-pre8","0.9.5-pre9","0.9.5.1","0.9.5.2","0.9.5.3","0.9.5.4","0.9.5.5"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-4.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-4.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-bouncycastle-jmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-bouncycastle-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-bouncycastle-pkix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-bouncycastle-prov","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-bouncycastle-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-angus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-angus-activation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-angus-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.0-1.GA_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.0-1.GA_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:33.0.0-3.jre_redhat_00004.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-guava-failureaccess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:33.0.0-3.jre_redhat_00004.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.19-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.48-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.48-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.48-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search-backend-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search-backend-lucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search-mapper-orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search-mapper-pojo-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-hibernate-search-util-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jakarta-activation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.2-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-metadata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-metadata-appclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-metadata-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-metadata-ear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-metadata-ejb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jboss-metadata-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jctools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-jctools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-transport-native-epoll-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-plexus-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-reactivex-rxjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.12-1.redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-reactivex-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.21-5.redhat_00003.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-client-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-4.Final_redhat_00002.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-http-client-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-http-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-http-naming-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-http-transaction-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.1-10.GA_redhat_00017.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-openssl-el8-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final.redhat.00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-openssl-el8-x86_64-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final.redhat.00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-openssl-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-yasson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-5.redhat_00007.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-bouncycastle-jmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-bouncycastle-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-bouncycastle-pkix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-bouncycastle-prov","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-bouncycastle-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.84.0-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-5.GA_redhat_00007.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-6.redhat_00012.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-angus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-angus-activation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-angus-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.0-1.GA_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.0-1.GA_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:33.0.0-3.jre_redhat_00004.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-guava-failureaccess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-guava-libraries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:33.0.0-3.jre_redhat_00004.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.19-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.48-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.48-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.48-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search-backend-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search-backend-lucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search-mapper-orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search-mapper-pojo-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-hibernate-search-util-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jakarta-activation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.2-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-metadata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-metadata-appclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-metadata-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-metadata-ear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-metadata-ejb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jboss-metadata-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.1.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jctools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-jctools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-transport-native-epoll-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.132-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-plexus-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-reactivex-rxjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.12-1.redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-reactivex-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.21-5.redhat_00003.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-client-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-4.Final_redhat_00002.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-http-client-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-http-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-http-naming-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-http-transaction-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.1-10.GA_redhat_00017.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-openssl-el9-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-openssl-el9-x86_64-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-openssl-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.Final_redhat_00001.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-yasson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-5.redhat_00007.1.el9eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.1-1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.1-1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.1-1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.1-1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.1-1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.1-1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"candlepin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.39-1.Final_redhat_00001.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.39-1.Final_redhat_00001.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hibernate-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.39-1.Final_redhat_00001.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.39-1.Final_redhat_00001.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hibernate-java8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.39-1.Final_redhat_00001.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap6.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap6.4-to-eap7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.2-to-eap7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.3-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly10.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly11.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly12.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly13.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly14.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly15.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly16.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly17.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly18.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly8.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-24.Final_redhat_00026.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-7.Final_redhat_00005.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-7.Final_redhat_00005.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.19-1.GA_redhat_00004.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.19-1.GA_redhat_00004.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.19-1.GA_redhat_00004.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.19-1.GA_redhat_00004.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.19-1.GA_redhat_00004.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-5.Final_redhat_00006.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-5.Final_redhat_00006.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-5.Final_redhat_00006.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-5.Final_redhat_00006.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-infinispan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-5.Final_redhat_00006.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-java8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-5.Final_redhat_00006.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-4.Final_redhat_00005.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-4.Final_redhat_00005.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.16-1.GA_redhat_00002.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.16-1.GA_redhat_00002.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.5-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mchange-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.20-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2"}]}],"versions":["0.9.1.2-9","0.9.1.2-9+deb8u1build0.16.04.1","0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"}]}],"versions":["0.9.1.2-9","0.9.1.2-9+deb8u1build0.18.04.1","0.9.1.2-9+deb8u1ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu0.20.04.1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu2+esm1"}]}],"versions":["0.9.1.2-10ubuntu1","0.9.1.2-10ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-10ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1.2-11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-11ubuntu0.1~esm1"}]}],"versions":["0.9.1.2-10ubuntu2","0.9.1.2-11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1"}]}],"versions":["0.9.1.2-9","0.9.1.2-9+deb8u1build0.18.04.1","0.9.1.2-9+deb8u1ubuntu0.18.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu0.20.04.1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu0.20.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu1+esm1"}]}],"versions":["0.9.1.2-10","0.9.1.2-10ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10ubuntu2+esm1"}]}],"versions":["0.9.1.2-10ubuntu1","0.9.1.2-10ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-11ubuntu0.1~esm1"}]}],"versions":["0.9.1.2-10ubuntu2","0.9.1.2-11"],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel 4.14.4 for spring boot 3.5.11"},{"vendor":"red hat","product":"red hat build of debezium 2"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of debezium 3.2"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1 for rhel 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1 for rhel 9"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.18 for rhel 9"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"},{"vendor":"swaldman","product":"c3p0"}],"references":[{"url":"https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal","tags":["x_refsource_MISC","article","web","report"]},{"url":"https://www.mchange.com/projects/c3p0/#configuring_security","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://www.mchange.com/projects/c3p0/#security-note","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27830","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442908","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27830.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28385","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4285","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3890","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27830","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5476-xc4j-rqcv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27830.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27830","tags":["advisory"]},{"url":"https://github.com/swaldman/c3p0","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1691","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/red_hat_jboss_enterprise_application_platform_installation_methods/index","tags":["article"]},{"url":"https://access.redhat.com/articles/7134190","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2337621","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444320","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458641","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-29032","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-31314","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-31468","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-31868","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-31874","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32025","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32028","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32064","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32074","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32078","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32084","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32123","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32209","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32212","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32266","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32293","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32295","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32339","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32350","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32415","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32481","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32486","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32544","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32601","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32687","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32755","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32773","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18054.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14813","tags":["advisory"]},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23368","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23368","tags":["advisory"]},{"url":"https://www.gruppotim.it/it/footer/red-team.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-67030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67030","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67030","tags":["advisory"]},{"url":"https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec","tags":["article"]},{"url":"https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642","tags":["article"]},{"url":"https://github.com/codehaus-plexus/plexus-utils/issues/294","tags":["article"]},{"url":"https://github.com/codehaus-plexus/plexus-utils/pull/295","tags":["article"]},{"url":"https://github.com/codehaus-plexus/plexus-utils/pull/296","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","tags":["advisory"]},{"url":"https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","tags":["article"]},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3505","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3505","tags":["advisory"]},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","tags":["advisory"]},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5598","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5598","tags":["advisory"]},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27446","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27446","tags":["advisory"]},{"url":"https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27727","tags":["advisory"]},{"url":"https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27830","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","tags":["article"]},{"url":"https://w4ke.info/2025/06/18/funky-chunks.html","tags":["article"]},{"url":"https://w4ke.info/2025/10/29/funky-chunks-2.html","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-32075","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18055.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-45570","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45571","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45836","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45883","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28385.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73644","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477232","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-34007","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73644.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42578","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42583","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42583","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42585","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42585","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73976","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/7.1.0_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-33911","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-34006","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73976.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260855-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258913","tags":["report"]},{"url":"https://bugzilla.suse.com/1258942","tags":["report"]},{"url":"https://bugzilla.suse.com/1259313","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27830","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261035-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213308","tags":["report"]},{"url":"https://bugzilla.suse.com/1214568","tags":["report"]},{"url":"https://bugzilla.suse.com/1214569","tags":["report"]},{"url":"https://bugzilla.suse.com/1216711","tags":["report"]},{"url":"https://bugzilla.suse.com/1217755","tags":["report"]},{"url":"https://bugzilla.suse.com/1220899","tags":["report"]},{"url":"https://bugzilla.suse.com/1221950","tags":["report"]},{"url":"https://bugzilla.suse.com/1223368","tags":["report"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1228577","tags":["report"]},{"url":"https://bugzilla.suse.com/1230876","tags":["report"]},{"url":"https://bugzilla.suse.com/1232125","tags":["report"]},{"url":"https://bugzilla.suse.com/1233496","tags":["report"]},{"url":"https://bugzilla.suse.com/1236066","tags":["report"]},{"url":"https://bugzilla.suse.com/1236799","tags":["report"]},{"url":"https://bugzilla.suse.com/1237536","tags":["report"]},{"url":"https://bugzilla.suse.com/1238481","tags":["report"]},{"url":"https://bugzilla.suse.com/1239636","tags":["report"]},{"url":"https://bugzilla.suse.com/1240565","tags":["report"]},{"url":"https://bugzilla.suse.com/1241013","tags":["report"]},{"url":"https://bugzilla.suse.com/1243241","tags":["report"]},{"url":"https://bugzilla.suse.com/1243679","tags":["report"]},{"url":"https://bugzilla.suse.com/1243768","tags":["report"]},{"url":"https://bugzilla.suse.com/1243808","tags":["report"]},{"url":"https://bugzilla.suse.com/1243876","tags":["report"]},{"url":"https://bugzilla.suse.com/1243881","tags":["report"]},{"url":"https://bugzilla.suse.com/1244177","tags":["report"]},{"url":"https://bugzilla.suse.com/1244542","tags":["report"]},{"url":"https://bugzilla.suse.com/1244648","tags":["report"]},{"url":"https://bugzilla.suse.com/1244724","tags":["report"]},{"url":"https://bugzilla.suse.com/1245241","tags":["report"]},{"url":"https://bugzilla.suse.com/1245307","tags":["report"]},{"url":"https://bugzilla.suse.com/1245405","tags":["report"]},{"url":"https://bugzilla.suse.com/1245766","tags":["report"]},{"url":"https://bugzilla.suse.com/1246421","tags":["report"]},{"url":"https://bugzilla.suse.com/1246981","tags":["report"]},{"url":"https://bugzilla.suse.com/1247038","tags":["report"]},{"url":"https://bugzilla.suse.com/1248741","tags":["report"]},{"url":"https://bugzilla.suse.com/1248804","tags":["report"]},{"url":"https://bugzilla.suse.com/1249502","tags":["report"]},{"url":"https://bugzilla.suse.com/1251864","tags":["report"]},{"url":"https://bugzilla.suse.com/1251995","tags":["report"]},{"url":"https://bugzilla.suse.com/1252937","tags":["report"]},{"url":"https://bugzilla.suse.com/1253024","tags":["report"]},{"url":"https://bugzilla.suse.com/1253068","tags":["report"]},{"url":"https://bugzilla.suse.com/1253158","tags":["report"]},{"url":"https://bugzilla.suse.com/1253322","tags":["report"]},{"url":"https://bugzilla.suse.com/1253501","tags":["report"]},{"url":"https://bugzilla.suse.com/1253773","tags":["report"]},{"url":"https://bugzilla.suse.com/1255298","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27830","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8642-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55223","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-27830","title":"c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","status":"published","published":"2026-02-26T00:45:18.222Z","modified":"2026-09-15T12:04:22.713Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502","CWE-94","CWE-502"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-8786","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","status":"published","published":"2026-02-26T00:45:18Z","modified":"2026-09-15T12:04:22Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-5476-xc4j-rqcv","title":"c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property","description":"### Impact\n\nc3p0 is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`.\n\nThe danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`.\n\nAlthough hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility.\n\n### Patches\n\nThe `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization.\n\nc3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. Those parameters are documented [here](https://www.mchange.com/projects/c3p0/#configuring_security).\n\nc3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names.\n\n### Workarounds\n\nUsers should upgrade to c3p0-0.12.0 or above. There is no supported workaround for earlier versions of c3p0.\n\n### References\n\n[c3p0, you little rascal \u0026mdash; Hans-Martin Münch](https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal/)\n[c3p0 documentation, security note](https://www.mchange.com/projects/c3p0/#security-note)\n[c3p0 documentation, configuring security](https://www.mchange.com/projects/c3p0/#configuring_security)","status":"published","published":"2026-02-25T18:35:23Z","modified":"2026-02-27T21:53:40Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-94","CWE-502"],"updated_at":"2026-11-02T14:39:28.962954Z"}],"nvd":[{"id":"CVE-2026-27830","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","status":"published","published":"2026-02-26T01:16:24.583Z","modified":"2026-09-14T13:17:54.607Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94","CWE-502"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"CVE-2026-27830","title":"c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","status":"published","published":"2026-02-26T00:45:18.222Z","modified":"2026-10-28T11:13:28.671323271Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-502","CWE-94"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-27830","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","status":"published","published":"2026-02-26T01:16:24.583Z","modified":"2026-10-01T03:03:08.324592008Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-5476-xc4j-rqcv","title":"c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property","description":"### Impact\n\nc3p0 is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`.\n\nThe danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`.\n\nAlthough hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility.\n\n### Patches\n\nThe `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization.\n\nc3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. Those parameters are documented [here](https://www.mchange.com/projects/c3p0/#configuring_security).\n\nc3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names.\n\n### Workarounds\n\nUsers should upgrade to c3p0-0.12.0 or above. There is no supported workaround for earlier versions of c3p0.\n\n### References\n\n[c3p0, you little rascal \u0026mdash; Hans-Martin Münch](https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal/)\n[c3p0 documentation, security note](https://www.mchange.com/projects/c3p0/#security-note)\n[c3p0 documentation, configuring security](https://www.mchange.com/projects/c3p0/#configuring_security)","status":"published","published":"2026-02-25T18:35:23Z","modified":"2026-09-10T03:50:34.26882649Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-502","CWE-94"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"OESA-2026-1691","title":"c3p0 security update","description":"c3p0 is a JDBC driver for extending traditional libraries (DriverManager-based libraries) with JNDI bindable data sources (including data sources), as described in the jdbc3 specification and jdbc2 standard extensions. They implement connections and statement pools.\r\n\r\nSecurity Fix(es):\n\nc3p0 is a JDBC connection pooling library. Prior to version 0.12.0, several `ConnectionPoolDataSource` implementations had a property called `userOverridesAsString`, which conceptually represents a `Map\u0026lt;String,Map\u0026lt;String,String\u0026gt;\u0026gt;` but was maintained as a hex-encoded Java serialized object. An attacker able to reset this property on an existing `ConnectionPoolDataSource`, or via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances, could trigger deserialization. Combined with vulnerabilities in its main dependency, mchange-commons-java, which includes code mirroring early JNDI implementations with ungated support for remote `factoryClassLocation` values, attackers could set c3p0\u0026apos;s `userOverridesAsString` to hex-encoded serialized objects that include objects \u0026quot;indirectly serialized\u0026quot; via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke the download and execution of malicious code from a remote `factoryClassLocation`, leading to arbitrary code execution on the application\u0026apos;s `CLASSPATH`.(CVE-2026-27830)","status":"published","published":"2026-03-20T11:10:43Z","modified":"2026-08-18T01:19:41.753758244Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:18054","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update","status":"published","published":"2026-05-19T10:06:30Z","modified":"2026-10-20T10:05:25Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:18055","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update","status":"published","published":"2026-05-19T10:06:30Z","modified":"2026-10-20T10:05:26Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:28385","title":"Red Hat Security Advisory: Satellite 6.18.6 Async Update","status":"published","published":"2026-06-24T10:08:39Z","modified":"2026-10-20T10:07:00Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:73644","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update","status":"published","published":"2026-10-01T10:20:58Z","modified":"2026-10-20T10:15:19Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73976","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update","status":"published","published":"2026-10-01T10:21:11Z","modified":"2026-10-20T10:15:23Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-27830","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","status":"published","published":"2026-02-26T01:16:00Z","modified":"2026-10-17T12:56:18.11305311Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"CLSA-2026-1784077471","title":"TuxCare security update for com.mchange:c3p0 (1 CVE)","description":"TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:23.876025227Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1788527318","title":"TuxCare security update for com.mchange:c3p0 (1 CVE)","description":"TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3.","status":"published","published":"2026-09-04T13:08:38Z","modified":"2026-10-15T09:47:34.020095753Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789371869","title":"TuxCare security update for com.mchange:c3p0 (2 CVEs)","description":"TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.1.","status":"published","published":"2026-09-14T07:44:29Z","modified":"2026-10-15T09:47:43.001156531Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789372000","title":"TuxCare security update for com.mchange:c3p0 (1 CVE)","description":"TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.2.1-tuxcare.1.","status":"published","published":"2026-09-14T07:46:40Z","modified":"2026-10-15T09:47:43.025796222Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789372028","title":"TuxCare security update for com.mchange:c3p0 (2 CVEs)","description":"TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.3-tuxcare.1.","status":"published","published":"2026-09-14T07:47:07Z","modified":"2026-10-15T09:47:43.000025981Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1793183878","title":"TuxCare security update for com.mchange:c3p0 (2 CVEs)","description":"TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.4-tuxcare.5.","status":"published","published":"2026-10-28T10:37:58Z","modified":"2026-10-28T13:45:03.597155516Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"SUSE-SU-2026:0855-1","title":"Security update for c3p0 and mchange-commons","description":"This update for c3p0 and mchange-commons fixes the following issues:\n\nc3p0:\n    \n- Security issues fixed:\n\n  - CVE-2026-27830: Fixed unsafe object deserialization (bsc#1258942)\n\n- Fix the null pointer exception in the userOverridesAsString\n  method (bsc#1259313).\n    \nmchange-commons:\n\n- Security issues fixed:\n\n  - CVE-2026-27727: Disabled remote ClassLoading when dereferencing javax.naming.Reference instances (bsc#1258913)\n\n","status":"published","published":"2026-03-10T05:06:36Z","modified":"2026-03-10T14:45:44.082839Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1035-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-03-25T10:21:15Z","modified":"2026-07-13T14:00:32.648174458Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-8642-1","title":"c3p0 vulnerabilities","description":"It was discovered that c3p0 was vulnerable to remote code execution via maliciously\ncrafted serialized objects and JNDI references. An attacker could use this to\nexecute arbitrary code, bypass security restrictions, or cause a denial of service.","status":"published","published":"2026-08-18T13:02:22Z","modified":"2026-10-07T04:30:03.248967216Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}