CVE-2026-119278: MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mariadb-connector-javato a version that resolves this vulnerability.Fixed in 3.5.10-1 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.3.7 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.4.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using MariaDB Connector/J versions from 3.0.0 through versions before 3.3.7 or 3.4.5 are affected when they perform caching_sha2_password authentication. Exploitation requires the application to connect to a malicious or compromised database server, or for an attacker to act as a machine in the middle.
Can this be exploited to obtain database passwords or alter data?
The malformed authentication response is processed before any password is transmitted. The described impact is client-side denial of service through excessive memory allocation or an unchecked ArrayIndexOutOfBoundsException; no confidentiality or integrity impact is stated.
What happens when exploitation succeeds?
A rogue server or machine-in-the-middle attacker can send a very large declared response length, potentially causing excessive memory allocation, or an empty response that causes an unchecked ArrayIndexOutOfBoundsException. The exception can escape from DriverManager.getConnection(), preventing the connection from being established.
What versions contain the fix?
The issue is fixed in MariaDB Connector/J 3.3.7 and 3.4.5. Upgrade to one of those fixed versions or a later applicable release.