{"id":"CVE-2026-119277","kind":"vulnerability","aliases":["CVE-2026-119277"],"related":[],"title":"MariaDB Connector/J: malformed server packets crash Java database connections","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","summary":"Connector/J decodes server packets using lengths the server declares without checking the bytes exist, so a malformed packet raises unchecked exceptions. The result is a terminated connection and failed JDBC calls, which a malicious server or a machine-in-the-middle can trigger.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdbc","mariadb","mysql","package"],"not_affected_if":["versions-outside-affected-range"],"how_to_check":null,"fix":"- Upgrade to `3.3.7` on the 3.3 line\n- Upgrade to `3.4.5` on the 3.4 line\n- Upgrade to `3.5.11` on the 3.5 line","status":"open","published_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:47+00:00","updated_at":"2026-10-29T21:28:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T21:28:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `3.3.7` on the 3.3 line\n- Upgrade to `3.4.5` on the 3.4 line\n- Upgrade to `3.5.11` on the 3.5 line","reach":"network","title":"MariaDB Connector/J: malformed server packets crash Java database connections","impact":"low","summary":"Connector/J decodes server packets using lengths the server declares without checking the bytes exist, so a malformed packet raises unchecked exceptions. The result is a terminated connection and failed JDBC calls, which a malicious server or a machine-in-the-middle can trigger.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mariadb","mysql","jdbc"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Connection handling terminates through unchecked exceptions in JDBC calls","analyst_note":"","how_to_check":"- Look for `mariadb-java-client` in the Java project's dependency tree (`mvn dependency:tree` or `gradle dependencies`)\n- Check the resolved version: 3.0.0 through 3.3.6, 3.4.0 through 3.4.4, and 3.5.0 through 3.5.10 are affected","plain_action":"","needs_analyst":false,"not_affected_if":["versions-outside-affected-range"],"who_is_affected":"Applications that use Connector/J to talk to MariaDB or MySQL servers, where the server could be untrusted or traffic could be intercepted. Exposure is mostly a denial of service on the connection; the sources do not describe code execution or data theft. Teams that only connect to a trusted, network-protected database server are lower risk but should still upgrade.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4291,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119277':12A,15A '-2026':11A,14A '3.0.0':81C '3.3.7':83C,170C '3.4.5':84C,171C '3.5.11':86C,173C 'applic':71C 'arrayindexoutofboundsexcept':153C 'attack':149C 'beyond':133C 'binari':102C 'block':94C 'boundari':136C 'buffer':120C,129C 'byte':33B,115C 'call':51B,159C 'check':31B 'column':95C 'compromis':140C 'confirm':111C 'connect':9A,47B,70C,162C 'connector/j':2A,21B,66C 'could':123C,150C 'crash':6A 'creat':126C 'cve':10A,13A 'data':100C,104C 'databas':8A,79C 'declar':29B,108C 'decod':22B,87C,122C,131C 'definit':96C 'develop':72C 'except':41B 'exist':34B 'fail':49B 'failur':156C 'fix':167C 'handl':163C 'illegalargumentexcept':155C 'insid':157C 'issu':165C 'java':7A,16B,74C 'jdbc':17B,50B,158C 'length':26B,109C 'machin':59B,145C 'machine-in-the-middl':58B,144C 'malform':3A,37B 'malici':54B,138C 'mariadb':1A,18B,65C,76C 'middl':62B,148C 'mysql':19B,78C 'ok':89C 'packag':20B 'packet':5A,24B,38B,90C,97C,135C 'posit':124C 'rais':39B 'read':125C 'receiv':119C 'remain':116C 'request':114C 'result':43B 'row':99C,103C 'server':4A,23B,28B,55B,107C,141C 'server-declar':106C 'session':92C 'session-st':91C 'state':93C 'string':132C 'sub':128C 'sub-buff':127C 'termin':46B,161C 'text':98C 'trigger':64B,151C 'uncheck':40B,152C 'use':25B,68C,105C 'version':169C 'without':30B,110C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Connector/J to talk to MariaDB or MySQL servers, where the server could be untrusted or traffic could be intercepted. Exposure is mostly a denial of service on the connection; the sources do not describe code execution or data theft. Teams that only connect to a trusted, network-protected database server are lower risk but should still upgrade.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119277","severity":null,"published_at":"2026-10-29T21:17:21+00:00","modified_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}