VYPR
← All advisories
High severityNVD Advisory· Published Apr 22, 2019· Updated Aug 4, 2024

CVE-2019-5427

CVE-2019-5427

Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

c3p0 versions before 0.9.5.4 are vulnerable to a billion laughs XML entity expansion attack, leading to denial of service.

Vulnerability

Overview

CVE-2019-5427 is a denial-of-service vulnerability in c3p0, a popular JDBC connection pooling library for Java. The vulnerability exists in versions prior to 0.9.5.4 and is rooted in the library's XML configuration parsing code. The implementation lacks protections against recursive entity expansion, allowing an attacker to craft a malicious XML configuration file that triggers a billion laughs attack [1].

Exploitation

To exploit this vulnerability, an attacker must be able to supply a malicious XML configuration to c3p0. This could be achieved if an application loads configuration from an untrusted source, such as a user-uploaded file or an external feed. No authentication is required if the attacker can influence the configuration loading process. The attack vector is network-based, and exploitation results in exponential memory consumption due to recursive entity expansion [1].

Impact

Successful exploitation leads to denial of service via memory exhaustion. The affected application may become unresponsive or crash, impacting availability. The vulnerability does not allow code execution or data theft, but it can be used to disrupt services that rely on c3p0 for database connections [1].

Mitigation

The vulnerability is fixed in c3p0 version 0.9.5.4. Users are strongly advised to upgrade to this version or later. For environments where upgrading immediately is not possible, limiting access to configuration files or validating XML inputs can reduce risk. The issue was reported via HackerOne and has been addressed in official releases [1]. Fedora packages have also been updated to include the fix [2][3].

References
  1. NVD - CVE-2019-5427
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.mchange:c3p0Maven
< 0.9.5.40.9.5.4

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.