DEBIAN-CVE-2026-119278: Medium severity debian/mariadb-connector-java vulnerability

Q: Which deployments are exposed to this issue?

Applications using MariaDB Connector/J versions from 3.0.0 through the affected releases are exposed when they authenticate with caching_sha2_password to a malicious or compromised database server, or when a machine-in-the-middle can alter the server response. The issue occurs before any password is transmitted.

Q: What can an attacker do, and what access do they need?

An attacker needs control of the database server or the ability to intercept and modify the connection traffic. They can send a malformed authentication-more-data packet that causes excessive memory allocation or an unhandled ArrayIndexOutOfBoundsException from DriverManager.getConnection(), resulting in denial of service.

Q: What should be done if an immediate upgrade is not possible?

Prevent connections to untrusted or compromised database servers and protect the connection path from machine-in-the-middle modification. Limiting use of caching_sha2_password where feasible also avoids the affected authentication path.

Q: How can I tell whether an application has encountered exploitation or a malformed response?

Look for connection failures from DriverManager.getConnection() involving an ArrayIndexOutOfBoundsException during caching_sha2_password authentication. Excessive memory allocation during authentication may also indicate receipt of a malformed server response.

Published Oct 29, 2026

Updated

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5.

Affected Software

3 affected componentsFixes available

debian/mariadb-connector-java*

debian/mariadb-connector-java<3.5.10-1

3.5.10-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/mariadb-connector-java to a version that resolves this vulnerability.
Fixed in 3.5.10-1
Upgrade
Upgrade MariaDB Connector/J to a version that resolves this vulnerability.
Fixed in 3.3.7
Upgrade
Upgrade MariaDB Connector/J to a version that resolves this vulnerability.
Fixed in 3.4.5

Event History

Oct 29, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using MariaDB Connector/J versions from 3.0.0 through the affected releases are exposed when they authenticate with caching_sha2_password to a malicious or compromised database server, or when a machine-in-the-middle can alter the server response. The issue occurs before any password is transmitted.

What can an attacker do, and what access do they need?

An attacker needs control of the database server or the ability to intercept and modify the connection traffic. They can send a malformed authentication-more-data packet that causes excessive memory allocation or an unhandled ArrayIndexOutOfBoundsException from DriverManager.getConnection(), resulting in denial of service.

What should be done if an immediate upgrade is not possible?

Prevent connections to untrusted or compromised database servers and protect the connection path from machine-in-the-middle modification. Limiting use of caching_sha2_password where feasible also avoids the affected authentication path.

How can I tell whether an application has encountered exploitation or a malformed response?

Look for connection failures from DriverManager.getConnection() involving an ArrayIndexOutOfBoundsException during caching_sha2_password authentication. Excessive memory allocation during authentication may also indicate receipt of a malformed server response.

DEBIAN-CVE-2026-119278: Medium severity debian/mariadb-connector-java vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an attacker do, and what access do they need?

What should be done if an immediate upgrade is not possible?

How can I tell whether an application has encountered exploitation or a malformed response?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an attacker do, and what access do they need?

What should be done if an immediate upgrade is not possible?

How can I tell whether an application has encountered exploitation or a malformed response?