CVE-2019-5427: Billion laughs attack in c3p0
Summary
CVE-2019-5427: Billion laughs attack in c3p0. Affects com.mchange:c3p0 versions < 0.9.5.4. Fixed in 0.9.5.4. How to fix ↓
Also tracked for
- c3p0 · Debian:11
The same CVE-2019-5427 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
c3p0 is a popular connection pooling library for Java applications. It provides efficient and reliable management of database connections, improving performance and scalability. However, versions prior to 0.9.5.4 are vulnerable to a billion laughs attack when loading XML configuration. This vulnerability arises due to missing protections against recursive entity expansion during the configuration loading process.
Vulnerability Detail
The billion laughs attack is a type of denial-of-service (DoS) attack that exploits the XML parser's ability to recursively expand entities. By crafting a malicious XML configuration file, an attacker can cause the parser to consume excessive resources, leading to a DoS condition. In the case of c3p0, this vulnerability can be triggered when loading the XML configuration, potentially impacting the availability of the application. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 0.14.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the loading of XML configuration files in c3p0. This can be achieved by configuring the library to use programmatic configuration instead of XML-based configuration. By avoiding the use of XML configuration, the vulnerability can be mitigated until a proper upgrade can be performed. Here's an example of how to configure c3p0 programmatically:
c3p0ComboPooledDataSource cpds = new c3p0ComboPooledDataSource();
cpds.setDriverClass("com.mysql.jdbc.Driver");
cpds.setJdbcUrl("jdbc:mysql://localhost/testdb");
cpds.setUser("dbuser");
cpds.setPassword("dbpassword");
// Set other connection pool properties
Conclusion
The billion laughs attack vulnerability in c3p0 can be mitigated by upgrading to version 0.9.5.4 or later, or by disabling the loading of XML configuration files. It is important to promptly address this vulnerability to ensure the security and availability of your application. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.mchange:c3p0 →
FAQ
A billion laughs attack is a type of denial-of-service (DoS) attack that exploits the recursive entity expansion capability of XML parsers. By crafting a malicious XML file, an attacker can cause the parser to consume excessive resources, leading to a DoS condition.
c3p0 is a connection pooling library for Java applications. It provides efficient management of database connections, improving performance and scalability.
The billion laughs attack affects c3p0 when loading XML configuration files. The vulnerability arises due to missing protections against recursive entity expansion, which can lead to a denial-of-service condition.
This vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, it is recommended to upgrade to c3p0 version 0.9.5.4 or later. Alternatively, you can disable the loading of XML configuration files and use programmatic configuration instead.
Related vulnerabilities
Recent vulnerabilities recorded for com.mchange:c3p0.
