CVE-2019-5427

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-22 · updated 2026-06-17
Weakness: CWE-776

Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Affected products

Fedoraproject Fedora: 29, 30
Mchange C3P0: before 0.9.5.4 — fixed in 0.9.5.4
Oracle Communications Ip Service Activator: 7.3.0, 7.4.0
Oracle Communications Session Route Manager: from 8.2.0 through 8.2.2
Oracle Documaker: from 12.6.0 through 12.6.6
Oracle Corporation Enterprise Manager Base Platform: 13.2.1.0
Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
Oracle Corporation Retail Xstore Point of Service: 15.0, 16.0, 17.0, 18.0, 19.0
Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0

How to fix

Upgrade to a fixed version: Mchange C3P0 0.9.5.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5427 or the next vulnerability affects your stack