Back Linuxsecurity Ubuntu 26.04 LTS c3p0 Important Remote Code Exec Vulnerability USN-8642
Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×
Several security issues were fixed in c3p0. Software Description: - c3p0: JDBC Connection pooling library Details: It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service.
Several security issues were fixed in c3p0.
Software Description:
- c3p0: JDBC Connection pooling library
It was discovered that c3p0 was vulnerable to remote code execution via maliciously
crafted serialized objects and JNDI references. An attacker could use this to
execute arbitrary code, bypass security restrictions, or cause a denial of service.
The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libc3p0-java 0.9.1.2-11ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS libc3p0-java 0.9.1.2-10ubuntu2+esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS libc3p0-java 0.9.1.2-10ubuntu1+esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS libc3p0-java 0.9.1.2-10ubuntu0.20.04.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libc3p0-java 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
CVE-2026-27727, CVE-2026-27830, CVE-2026-55153, CVE-2026-55223
Ubuntu Security Notice USN-8642-1
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
