GHSA-w6w4-rjh9-9r58
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
com.mchange:c3p0Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The JDBC spec defines the interface DataSource, with a method called getConnection(), and ConnectionPoolDataSource, with a method called getPooledConnection(). These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated, flexible tools which may be, and in practice sometimes have proven to be, susceptible to abuse.
Unfortunately, the JavaBean framework treats methods of this form, getXXX(), as JavaBean "properties", which JavaBean-related libraries often presume represent quick, safe-to-look-up, state or configuration.
Attackers therefore can construct malicious DataSource objects — objects whose calls to getConnection() or getPooledConnection() would trigger attacks via vulnerable JDBC drivers — and bundle them in contexts that automatically look up bean properties on deserialization. If an attacker can smuggle such an object in serialized form to a location from which an application will deserialize it, an attack is triggered.
It's not easy. It requires that a susceptible JDBC DataSource or ConnectionPoolDataSource be available on the application CLASSPATH, along with a susceptible JDBC driver, and a carrier that will automatically look up JavaBean properties on deserialization. In practice, the most common such carrier is the composition of a collection and a Comparator implementation that sorts based on JavaBean properties from Apache commons-beanutils.
But c3p0 prior to 0.14.0 offered the susceptible JDBC DataSource or ConnectionPoolDataSource, supplying an essential component of the trigger.
Patches
c3p0 versions 0.14.0 and above no longer participate in this class of attack, because they include explicit BeanInfo classes which exclude connection and pooledConnection from the list of "introspected" JavaBean properties. Since getConnection() and getPooledConnection() no longer define JavaBean properties, classes that promiscuously read JavaBean properties do not call them, and the attack is averted.
Workarounds
If users can ensure the safety of all JDBC drivers on the application CLASSPATH, or that no libraries lie on the CLASSPATH that can be composed to trigger automatic JavaBean property lookups on deserialization, then this attack is prevented. Nevertheless, given the complexity of modern JDBC drivers and typical Java application transitive dependencies, it is strongly recommended that users upgrade to c3p0 version 0.14.0 or higher.
Some versions of this attack are foiled by the stronger encapsulation and restriction of reflective access introduced in Java 16. Running applications on Java 16+ is therefore a potential mitigation.
This attack is described by Hans-Martin Münch in a blog post called "Look Mama, no TemplatesImpl".
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.mchange:c3p0 | all versions | 0.14.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.mchange:c3p0. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update com.mchange:c3p0 to 0.14.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-w6w4-rjh9-9r58 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-w6w4-rjh9-9r58 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-w6w4-rjh9-9r58. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-w6w4-rjh9-9r58 in your dependencies?
O3 detects GHSA-w6w4-rjh9-9r58 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.