THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-27830 (HIGH 8.0) — c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually repre

[NVD] CVE-2026-27830 (HIGH 8.0) — c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually repre

lownvdPublished 2026-02-26

CVE-2026-27830 CVSS: 8.0 HIGH Published: 2026-02-26T01:16:24.583

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.

MITRE ATT&CK techniques

VulnerabilitiesT1588.006

Indicators of compromise

CVE-2026-27830cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-27830