CVE-2026-55223
CVE-2026-55223: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-55223] Remote code execution via deserialization vulnerability
CVE-2026-55223Source published Source updated
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on =…
- Affected products in this advisory
- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Debezium 3
- Red Hat Fuse 7
1 more entries in the full advisory.
- Source-reported affected versions
- < 0.14.0
- Source-reported fixed versions
- 0.14.0
- c3p0
- RHSA-2026:54622
- Mitigation guidance
- Any of the following can reduce the risk or render exploitation not-feasible: - Run applications on Java 16 or later, which restricts reflective access and partially blocks the JavaBean property lookup step of the attack chain. - Remove Apache Commons BeanUtils from the classpath if it is not required, eliminating the most common deserialization carrier. - Ensure the application does not deserialize untrusted input from network sources. Red Hat recommends updating c3p0 to version 0.14.0 or later when a fix is available, which adds explicit BeanInfo classes to exclude the dangerous properties from JavaBean introspection.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.