{"id":"CVE-2026-119276","kind":"vulnerability","aliases":["CVE-2026-119276"],"related":[],"title":"MariaDB Connector/J: malformed server packet forces memory exhaustion in Java clients","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, trusts length fields in OK packets before checking the bytes exist when session tracking is on. A malicious server or man-in-the-middle can make the client allocate large amounts of memory, causing garbage-collection pressure or an OutOfMemoryError in the application.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdbc","mariadb-connector-j","mysql","package"],"not_affected_if":["not-using-connector-j","trusted-database-network"],"how_to_check":null,"fix":"- `mariadb-java-client` 3.3.7\n- `mariadb-java-client` 3.4.5\n- `mariadb-java-client` 3.5.11","status":"open","published_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:50+00:00","updated_at":"2026-10-29T21:28:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:50Z","model":"claude-haiku-5-5","output":{"fix":"- `mariadb-java-client` 3.3.7\n- `mariadb-java-client` 3.4.5\n- `mariadb-java-client` 3.5.11","reach":"network","title":"MariaDB Connector/J: malformed server packet forces memory exhaustion in Java clients","impact":"low","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, trusts length fields in OK packets before checking the bytes exist when session tracking is on. A malicious server or man-in-the-middle can make the client allocate large amounts of memory, causing garbage-collection pressure or an OutOfMemoryError in the application.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mariadb-connector-j","mysql","jdbc"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"client application runs out of memory or slows from garbage collection","analyst_note":"","how_to_check":"- Check the Connector/J version in the project's build file (for example `pom.xml` or `build.gradle`) and look for `mariadb-java-client` versions from 3.0.0 up to 3.3.6, 3.4.4, or 3.5.10\n- Check whether connections are made with `CLIENT_SESSION_TRACK` negotiated (session tracking enabled by default on the server)","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-connector-j","trusted-database-network"],"who_is_affected":"Java applications that use MariaDB Connector/J versions 3.0.0 through 3.3.6, 3.4.0 through 3.4.4, or 3.5.0 through 3.5.10 to reach MariaDB or MySQL. The attacker must be the database server itself or sit on the network path to it, so applications connecting only to a trusted, controlled database on a private network carry less exposure. Applications that do not use this driver are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4319,"output_tokens":700,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119276':14A,17A '-2026':13A,16A '3.0.0':96C '3.3.7':98C,201C '3.4.5':99C,202C '3.5.11':101C,204C 'alloc':64B,113C,175C 'amount':66B 'applic':79B,86C,194C 'array':115C 'attack':156C,172C 'attacker-control':171C 'byte':44B,114C,139C 'caus':69B 'check':42B 'client':11A,63B,103C,193C 'collect':72B,186C 'compromis':147C 'confirm':136C 'connect':85C 'connector':22B 'connector/j':2A,27B,81C 'control':173C 'copi':179C 'could':157C,182C 'creat':183C 'cve':12A,15A 'databas':94C 'declar':119C,163C 'develop':87C 'driver':30B 'exhaust':8A 'exist':45B 'fail':180C 'field':37B,126C 'fix':198C 'forc':6A,170C 'garbag':71B,185C 'garbage-collect':70B,184C 'heap':174C 'info':125C 'issu':196C 'j':23B 'java':10A,18B,29B,89C 'jdbc':19B 'larg':65B 'larger':166C 'length':36B,120C,167C 'machin':152C 'machine-in-the-middl':151C 'make':61B 'malform':3A 'malici':52B,145C 'man':56B 'man-in-the-middl':55B 'mariadb':1A,21B,26B,32B,80C,91C 'mariadb-connector-j':20B 'memori':7A,68B 'middl':59B,155C 'much':165C 'mysql':24B,34B,93C 'name':132C 'negoti':107C 'ok':39B,123C,161C 'okpacket.parse':109C 'okpacket.parsewithinfo':111C 'outofmemoryerror':76B,190C 'packag':25B 'packet':5A,40B,124C,143C,162C 'path':112C 'pressur':73B,187C 'remain':140C 'repeat':169C 'send':158C 'server':4A,53B,118C,148C 'server-declar':117C 'session':47B,104C,129C 'session-st':128C 'small':160C 'state':130C 'subsequ':178C 'track':48B,105C 'trust':35B 'use':83C,116C 'valu':134C 'variabl':131C 'version':200C","nicknames":[],"mitigations":[],"who_affected":"Java applications that use MariaDB Connector/J versions 3.0.0 through 3.3.6, 3.4.0 through 3.4.4, or 3.5.0 through 3.5.10 to reach MariaDB or MySQL. The attacker must be the database server itself or sit on the network path to it, so applications connecting only to a trusted, controlled database on a private network carry less exposure. Applications that do not use this driver are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119276","severity":null,"published_at":"2026-10-29T21:17:20+00:00","modified_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}