CVE-2026-119277: MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.3.7 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.4.5 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.5.11
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Java applications using MariaDB Connector/J versions affected by this issue are exposed when they connect to a malicious or compromised database server, or when an attacker can act as a machine in the middle of the database connection.
What does an attacker need to cause an impact?
The attacker must be able to supply crafted database protocol packets, either by controlling or compromising the server or by intercepting and modifying traffic between the application and the server. No application-side privileges or user interaction are required.
How can I identify potentially affected clients?
Identify applications using MariaDB Connector/J and check whether they run a version before 3.3.7, 3.4.5, or 3.5.11 in the applicable release line. Runtime symptoms may include unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures during JDBC connection handling.
Which versions contain the fix?
The issue is fixed in MariaDB Connector/J 3.3.7, 3.4.5, and 3.5.11.