High [CVE-2026-55223] Remote code execution via deserialization vulnerability
This high-severity Red Hat Linux advisory covers CVE-2026-55223 affecting Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Debezium 3.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets.
The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers.
Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack.
This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger.
This issue has been fixed in version 0.14.0. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object.
This requires specific conditions, including the presence of a susceptible JDBC driver and a mechanism for automatic property resolution during deserialization.
- < 0.14.0
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
- 0.14.0
- c3p0
- RHSA-2026:54622
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Mitigation checklist
- Any of the following can reduce the risk or render exploitation not-feasible: - Run applications on Java 16 or later, which restricts reflective access and partially blocks the JavaBean property lookup step of the attack chain. - Remove Apache Commons BeanUtils from the classpath if it is not required, eliminating the most common deserialization carrier. - Ensure the application does not deserialize untrusted input from network sources. Red Hat recommends updating c3p0 to version 0.14.0 or later when a fix is available, which adds explicit BeanInfo classes to exclude the dangerous properties from JavaBean introspection.
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.