Get real-time updates on Telegram
P5
CVE-2026-55223: c3p0 < 0.14.0
CVE-2026-55223. EPSS 0.0048 (percentile 0.40535), scored 24-Oct-2026.
Affected technology
c3p0 · < 0.14.0
swaldman
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality, integrity and availability impact as low.
- CWE
- CWE-502, CWE-915
- CCR priority
- 0.1 /100 (P5)
- EPSS
- 0.0048 · percentile 0.41142 · 2026-10-25
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-25 19:52:47.952465+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-25 19:51:06.643138+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-55223.html