{"id":"CVE-2026-119279","kind":"vulnerability","aliases":["CVE-2026-119279"],"related":[],"title":"MariaDB Connector/J: oversized length value from server crashes or misallocates client","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10.","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, mishandles unsigned 8-byte length fields from the database server, narrowing them to a Java int without a range check. A malicious or compromised server, or an attacker in the middle of the connection, can cause exceptions, out-of-bounds failures or oversized allocations in the client.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdbc","mariadb","mysql","package"],"not_affected_if":["trusted-server-only","version-outside-range"],"how_to_check":"- Check the Connector/J version in the project's build file (for example `pom.xml` or `build.gradle`) or the `mariadb-java-client` jar on the classpath.\n- Confirm whether the app connects to a server that is not fully trusted or over a network path an attacker could intercept.","fix":"- Move to `3.3.7`, `3.4.5`, or `3.5.10` depending on the release line in use.","status":"open","published_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:46+00:00","updated_at":"2026-10-29T21:28:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `3.3.7`, `3.4.5`, or `3.5.10` depending on the release line in use.","reach":"network","title":"MariaDB Connector/J: oversized length value from server crashes or misallocates client","impact":"medium","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, mishandles unsigned 8-byte length fields from the database server, narrowing them to a Java int without a range check. A malicious or compromised server, or an attacker in the middle of the connection, can cause exceptions, out-of-bounds failures or oversized allocations in the client.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mariadb","mysql","jdbc"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"malicious server causes client crash or oversized memory allocation","analyst_note":"","how_to_check":"- Check the Connector/J version in the project's build file (for example `pom.xml` or `build.gradle`) or the `mariadb-java-client` jar on the classpath.\n- Confirm whether the app connects to a server that is not fully trusted or over a network path an attacker could intercept.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range","trusted-server-only"],"who_is_affected":"Applications that use MariaDB Connector/J from 3.0.0 up to but not including 3.3.7, 3.4.5, or 3.5.10 to talk to MariaDB or MySQL. The risk depends on trusting the database server and the network path between client and server; an application connecting only to a trusted, private database over a protected link is at lower risk. Applications on other drivers or versions outside those ranges are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4320,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119279':14A,17A '-2026':13A,16A '3.0.0':96C '3.3.7':98C,187C '3.4.5':99C,188C '3.5.10':101C,190C '8':34B,112C 'alloc':76B,147C,175C 'applic':86C 'attack':59B,164C 'behavior':176C 'bound':72B,171C 'byte':35B,113C 'caus':67B 'check':51B,123C 'client':11A,79B,178C 'compromis':55B,155C 'connect':65B,85C,179C 'connector/j':2A,24B,81C 'could':137C,165C 'crash':8A 'cve':12A,15A 'databas':40B,94C 'develop':87C 'downstream':146C 'driver':27B 'encod':116C 'except':68B 'failur':73B,172C 'field':37B 'fit':127C 'fix':184C 'handl':180C 'int':47B,121C 'integ':117C,132C 'integer.max':135C 'issu':182C 'java':18B,26B,46B,89C,120C 'jdbc':19B 'length':4A,36B,115C,144C 'length-encod':114C 'machin':160C 'machine-in-the-middl':159C 'malici':53B,153C 'mariadb':1A,20B,23B,29B,80C,91C 'method':106C 'middl':62B,163C 'misalloc':10A 'mishandl':32B 'mysql':21B,31B,93C 'narrow':42B,107C 'negat':131C,141C 'negativearraysizeexcept':167C 'non':130C 'non-neg':129C 'out-of-bound':69B,168C 'overs':3A,75B,174C 'packag':22B 'path':150C 'protocol':109C 'rang':50B 'read':149C 'readablebytebuf.readintlengthencodednotnull':105C 'readablebytebuf.readlength':103C 'server':7A,41B,56B,156C 'trigger':166C 'unrel':143C 'unsign':33B,111C 'use':83C,151C 'valu':5A,126C,133C,136C 'version':186C 'without':48B,122C 'wrap':138C","nicknames":[],"mitigations":[],"who_affected":"Applications that use MariaDB Connector/J from 3.0.0 up to but not including 3.3.7, 3.4.5, or 3.5.10 to talk to MariaDB or MySQL. The risk depends on trusting the database server and the network path between client and server; an application connecting only to a trusted, private database over a protected link is at lower risk. Applications on other drivers or versions outside those ranges are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119279","severity":null,"published_at":"2026-10-29T21:17:21+00:00","modified_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}