{"id":"CVE-2026-119280","kind":"vulnerability","aliases":["CVE-2026-119280"],"related":[],"title":"MariaDB Connector/J: XA recovery trusts server lengths, enabling crashes and large allocations","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","summary":"MariaDB Connector/J is a Java library for connecting applications to MariaDB and MySQL. A malicious or compromised database server, or an attacker in the middle, can send crafted XA RECOVER lengths that cause huge memory allocations or exceptions during recovery.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdbc","mariadb","mysql","package","xa-transactions"],"not_affected_if":["fixed-version","no-xa-transactions","other-jdbc-driver"],"how_to_check":null,"fix":"- `mariadb-java-client` 3.3.7\n- `mariadb-java-client` 3.4.5\n- `mariadb-java-client` 3.5.11","status":"open","published_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:55+00:00","updated_at":"2026-10-29T21:28:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:55Z","model":"claude-haiku-5-5","output":{"fix":"- `mariadb-java-client` 3.3.7\n- `mariadb-java-client` 3.4.5\n- `mariadb-java-client` 3.5.11","reach":"network","title":"MariaDB Connector/J: XA recovery trusts server lengths, enabling crashes and large allocations","impact":"low","summary":"MariaDB Connector/J is a Java library for connecting applications to MariaDB and MySQL. A malicious or compromised database server, or an attacker in the middle, can send crafted XA RECOVER lengths that cause huge memory allocations or exceptions during recovery.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mariadb","mysql","jdbc","xa-transactions"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"crashes the application or exhausts memory during XA recovery","analyst_note":"","how_to_check":"- Check the MariaDB Connector/J version in your build file (for example the `mariadb-java-client` dependency in Maven or Gradle), and see whether it is `3.0.0` through `3.3.6`, `3.4.x` before `3.4.5`, or `3.5.x` before `3.5.11`.\n- Check whether the application uses XA (distributed transactions) with pooled connections, since the flaw sits in the recover() path.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-xa-transactions","other-jdbc-driver"],"who_is_affected":"Only applications that use the MariaDB Connector/J library in versions 3.0.0 through the fixed releases and call XA recovery on pooled connections are exposed. The attacker needs to control or sit between the application and the database server. Applications on other drivers or on fixed versions can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000761,"input_tokens":4322,"output_tokens":658,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119280':15A,18A '-2026':14A,17A '3.0.0':83C '3.3.7':85C,155C '3.4.5':86C,156C '3.5.11':88C,158C 'actual':123C 'alloc':12A,62B,108C,142C 'applic':35B,73C 'array':113C 'arrayindexoutofboundsexcept':145C 'attack':48B,138C 'bqual':99C 'byte':112C 'caus':59B,140C 'column':101C 'compromis':43B,129C 'connect':34B,72C 'connector/j':2A,28B,68C 'could':139C 'craft':54B 'crash':9A 'cve':13A,16A 'data':124C 'databas':44B,81C 'develop':74C 'enabl':8A 'except':64B 'fix':152C 'gtrid':96C 'huge':60B 'implement':93C 'issu':150C 'java':19B,31B,76C 'jdbc':20B 'larg':11A,141C 'length':7A,57B,97C,100C,117C 'librari':32B 'machin':134C 'machine-in-the-middl':133C 'malici':41B,127C 'mariadb':1A,21B,27B,37B,67C,78C 'mariadbpoolconnection.recover':90C 'mariadbpoolpinnedconnection.recover':92C 'memori':61B 'method':107C 'middl':51B,137C 'mysql':22B,39B,80C 'negativearraysizeexcept':143C 'packag':23B 'payload':125C 'recov':56B,105C 'recoveri':4A,66B,148C 'return':102C 'send':53B 'server':6A,45B,130C 'split':110C 'transact':26B 'trust':5A,94C 'use':70C 'valid':115C 'version':154C 'without':114C 'xa':3A,25B,55B,104C,147C 'xa-transact':24B 'xid':111C 'xid.maxbqualsize':120C 'xid.maxgtridsize':119C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the MariaDB Connector/J library in versions 3.0.0 through the fixed releases and call XA recovery on pooled connections are exposed. The attacker needs to control or sit between the application and the database server. Applications on other drivers or on fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119280","severity":null,"published_at":"2026-10-29T21:17:21+00:00","modified_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}