com.mchange:c3p0 vulnerabilities (Maven)

4 vulnerabilities.

• com.mchange:c3p0 Maven c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties CVE-2026-55223 Fix available 6.3 MediumJune 30, 2026
• com.mchange:c3p0 Maven c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property CVE-2026-27830 Fix available 8.9 HighFebruary 25, 2026
• com.mchange:c3p0 Maven Billion laughs attack in c3p0 CVE-2019-5427 Public exploitFix available 7.5 HighApril 22, 2019
• com.mchange:c3p0 Maven XML External Entity Reference in mchange:c3p0 CVE-2018-20433 Public exploitFix available 9.8 CriticalDecember 24, 2018