CVE-2019-5427

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.5

EPSS

4.88%

Published

Apr 22, 2019

Modified

Sep 5, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-776CWE-776

Affected Products (19)

mchange · c3p0 (up to 0.9.5.4)vulnerable

fedoraproject · fedoravulnerable

oracle · communications_ip_service_activatorvulnerable

oracle · communications_session_route_managervulnerable

oracle · documakervulnerable

oracle · enterprise_manager_base_platformvulnerable

oracle · enterprise_manager_ops_centervulnerable

oracle · flexcube_private_bankingvulnerable

oracle · hyperion_infrastructure_technologyvulnerable

oracle · retail_xstore_point_of_servicevulnerable

oracle · webcenter_sitesvulnerable

References (16)

https://hackerone.com/reports/509315

ExploitIssue TrackingPatch

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Third Party Advisory

https://hackerone.com/reports/509315

ExploitIssue TrackingPatch

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs