{"action":"Upgrade com.mchange:c3p0 to 0.14.0 or later.","affected":[{"fixed":"0.14.0","introduced":"0"}],"component":"com.mchange:c3p0","cve_ids":["CVE-2026-55223"],"ecosystem":"Maven","epss":0.0048,"exploited":false,"fixed_versions":["0.14.0"],"ghsa_id":"GHSA-w6w4-rjh9-9r58","id":"tcs_01M5N9FRVNK771362S7BGH7TPC","modified_at":"2026-07-23T20:00:25.133236466Z","published_at":"2026-07-23T19:46:53Z","references":["https://osv.dev/vulnerability/GHSA-w6w4-rjh9-9r58","https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58","https://nvd.nist.gov/vuln/detail/CVE-2026-55223","https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27","https://github.com/swaldman/c3p0","https://github.com/swaldman/c3p0/releases/tag/v0.14.0"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-w6w4-rjh9-9r58","url":"https://osv.dev/vulnerability/GHSA-w6w4-rjh9-9r58"},{"source":"nvd","source_id":"CVE-2026-55223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55223"}],"summary":"c3p0 can, in combination with other libraries, compose to a \"sink\" for deserialization gadgets"}