Live › vulnerability › CVE-2026-119279
MariaDB Connector/J, the Java driver for MariaDB and MySQL, mishandles unsigned 8-byte length fields from the database server, narrowing them to a Java int without a range check. A malicious or compromised server, or an attacker in the middle of the connection, can cause exceptions, out-of-bounds failures or oversized allocations in the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Applications that use MariaDB Connector/J from 3.0.0 up to but not including 3.3.7, 3.4.5, or 3.5.10 to talk to MariaDB or MySQL. The risk depends on trusting the database server and the network path between client and server; an application connecting only to a trusted, private database over a protected link is at lower risk. Applications on other drivers or versions outside those ranges are not affected.
No product ranges from the sources yet.
pom.xml or build.gradle) or the mariadb-java-client jar on the classpath.3.3.7, 3.4.5, or depending on the release line in use.3.5.10Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-119279")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.