c3p0, a popular JDBC connection‑pooling library, uses a property named userOverridesAsString to store a hex‑encoded Java‑serialized object. Deserialization of this property, or of supplied java‑serialized objects or javax.naming.Reference instances, allows an attacker to execute arbitrary code on the application’s classpath. The flaw exploits deserialization of untrusted data (CWE‑502) and indirect code injection via references (CWE‑94). If an attacker can reset the property or supply crafted serialized content, they may trigger download and execution of code from a remote JNDI location, leading to full compromise of confidentiality, integrity, and availability.

The affected product is c3p0, developed by Swaldman. Versions of c3p0 earlier than 0.12.0 are vulnerable. The fix is included in c3p0 0.12.0 and later, which replaces the hex‑encoded serialized format with a CSV‑based format and tightens support for remote JNDI names.

The CVSS score of 8.9 marks the vulnerability as high severity, and although the EPSS score is below 1%, the potential impact justifies serious concern. The vulnerability is not yet listed in the CISA KEV catalog. Attack delivery requires the ability to inject a malicious serialized payload or JNDI reference into the userOverridesAsString property, which may be possible in applications that expose this configuration or accept external serialized data. Once exploited, unbounded code execution can occur, making this a critical asset to mitigate.