Live › vulnerability › CVE-2026-119280
MariaDB Connector/J is a Java library for connecting applications to MariaDB and MySQL. A malicious or compromised database server, or an attacker in the middle, can send crafted XA RECOVER lengths that cause huge memory allocations or exceptions during recovery.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Only applications that use the MariaDB Connector/J library in versions 3.0.0 through the fixed releases and call XA recovery on pooled connections are exposed. The attacker needs to control or sit between the application and the database server. Applications on other drivers or on fixed versions can skip it.
No product ranges from the sources yet.
Unknown from the sources.
mariadb-java-client 3.3.7mariadb-java-client 3.4.5mariadb-java-client 3.5.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-119280")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.