{"items":[{"id":"NVI-00016074","kind":"vulnerability","title":"c3p0 can, in combination with other libraries, compose to a \"sink\" for deserialization gadgets","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-w6w4-rjh9-9r58","CVE-2026-55223"],"plain_summary":"GitHub lists this reviewed advisory for com.mchange:c3p0. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-669399e4857b1bd1224c42e0ab376c47"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-25T17:10:00.197Z","value":"6.3 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-669399e4857b1bd1224c42e0ab376c47"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-172b85623f90d2a2e08aac29f3daeb39","url":"https://github.com/advisories/GHSA-w6w4-rjh9-9r58","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w6w4-rjh9-9r58","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T17:42:43.803Z"},{"id":"sr-669399e4857b1bd1224c42e0ab376c47","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55223","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-55223","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:26.418Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-172b85623f90d2a2e08aac29f3daeb39"],"technology":"com.mchange:c3p0","known_exclusions":[],"conditions_summary":"### Impact\n\nThe JDBC spec defines the interface `DataSource`, with a method called `getConnection()`, and `ConnectionPoolDataSource`, with a method called `getPooledConnection()`. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated, flexible tools which may be, and in practice sometimes have proven to be, susceptible to abuse.\n\nUnfortunately, the JavaBean framework treats methods of this form, `getXXX()`, as JavaBean \"properties\", which JavaBean-related libraries often presume represent quick, safe-to-look-up, state or configuration.\n\nAttackers therefore can construct malicious `DataSource` objects — objects whose calls to `getConnection()` or `getPooledConnection()` would trigger attacks via vulnerable JDBC drivers — and bundle them in contexts that automatically look up bean properties on deserialization. If an attacker can smuggle such an object in serialized form to a location from which an application will deserialize it, an attack is triggered.\n\nIt's not easy. It requires that a susceptible JDBC `DataSource` or `ConnectionPoolDataSource` be available on the application `CLASSPATH`, along with a sus","public_affected_ranges":["< 0.14.0"]}],"null_published_at":"2026-11-08T19:53:44.064Z","source_updated_at":"2026-07-23T19:46:54.000Z","source_disclosed_at":"2026-07-23T19:46:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T17:42:43.803Z"},{"id":"NVI-00016074","kind":"vulnerability","title":"c3p0 can, in combination with other libraries, compose to a \"sink\" for deserialization gadgets","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w6w4-rjh9-9r58","CVE-2026-55223"],"plain_summary":"GitHub lists this reviewed advisory for com.mchange:c3p0. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-172b85623f90d2a2e08aac29f3daeb39"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-172b85623f90d2a2e08aac29f3daeb39","url":"https://github.com/advisories/GHSA-w6w4-rjh9-9r58","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w6w4-rjh9-9r58","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T17:42:43.803Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-172b85623f90d2a2e08aac29f3daeb39"],"technology":"com.mchange:c3p0","known_exclusions":[],"conditions_summary":"### Impact\n\nThe JDBC spec defines the interface `DataSource`, with a method called `getConnection()`, and `ConnectionPoolDataSource`, with a method called `getPooledConnection()`. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated, flexible tools which may be, and in practice sometimes have proven to be, susceptible to abuse.\n\nUnfortunately, the JavaBean framework treats methods of this form, `getXXX()`, as JavaBean \"properties\", which JavaBean-related libraries often presume represent quick, safe-to-look-up, state or configuration.\n\nAttackers therefore can construct malicious `DataSource` objects — objects whose calls to `getConnection()` or `getPooledConnection()` would trigger attacks via vulnerable JDBC drivers — and bundle them in contexts that automatically look up bean properties on deserialization. If an attacker can smuggle such an object in serialized form to a location from which an application will deserialize it, an attack is triggered.\n\nIt's not easy. It requires that a susceptible JDBC `DataSource` or `ConnectionPoolDataSource` be available on the application `CLASSPATH`, along with a sus","public_affected_ranges":["< 0.14.0"]}],"null_published_at":"2026-11-04T10:04:27.878Z","source_updated_at":"2026-07-23T19:46:54.000Z","source_disclosed_at":"2026-07-23T19:46:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T17:42:43.803Z"}],"next_cursor":null,"snapshot_revision":"42594"}