CVE-2026-27830 — c3p0 RCE via unsafe deserialization of userOverridesAsString. Current v4 has 0.9.5.4, fix requires 0.12.0+