CVE-2026-101678

Overview

MySQL Connector/J is the official JDBC Type 4 driver for MySQL, developed and released by the MySQL team at Oracle. It lets Java applications connect to and query MySQL servers over JDBC, and also implements the X DevAPI for document-store access. It is distributed as the Maven artifact com.mysql:mysql-connector-j and is a standard dependency in Java applications that talk to MySQL.

A denial of service vulnerability (CVE-2026-101678) has been identified in the MySQL Connector/J result set readers, which allows attackers who control or impersonate the MySQL server to send a result set header with an out-of-range column count and cause a partial denial of service in the client application.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects MySQL Connector/J version 26.7.0.

Details

Module Info

• Product: MySQL Connector/J
• Affected packages: com.mysql:mysql-connector-j
• Affected versions: 26.7.0
• GitHub repository: https://github.com/mysql/mysql-connector-j
• Published packages: https://central.sonatype.com/artifact/com.mysql/mysql-connector-j
• Package manager: Maven
• Fixed in:
  • OSS MySQL Connector/J 26.10.0
  • NES for MySQL Connector/J v8.0.35

Vulnerability Info

This Medium-severity vulnerability is found in the com.mysql:mysql-connector-j package in version 26.7.0 of MySQL Connector/J. When a query returns a result, the driver reads the column count from the first packet of the server's response as a length-encoded integer and trusts it without any range check. TextResultsetReader (and the equivalent code in BinaryResultsetReader for server-side prepared statements) passes the value straight on to the column metadata reader:

long columnCount = resultPacket.readInteger(IntegerDataType.INT_LENENC);

if (columnCount > 0) {
    // Build a result set with rows.

    // Read in the column information
    ColumnDefinition cdef = this.protocol.read(ColumnDefinition.class, new ColumnDefinitionFactory(columnCount, metadata));

ColumnDefinitionReader then narrows the 64-bit value to an int and uses it to size the array that holds the column definitions:

long columnCount = cdf.getColumnCount();
...
Field[] fields = new Field[(int) columnCount];

for (int i = 0; i < columnCount; i++) {
    NativePacketPayload fieldPacket = this.protocol.readMessage(null);

A MySQL protocol result set can have at most 65535 columns, but nothing enforces that bound. A malicious server, or an attacker able to tamper with an unencrypted connection, can report a column count close to Integer.MAX_VALUE, which makes the driver try to allocate a multi-gigabyte array and can exhaust the client's heap with an OutOfMemoryError. A count above Integer.MAX_VALUE wraps to a negative or truncated int when cast, so the allocation fails with a NegativeArraySizeException, or the array is smaller than the loop bound and the read fails with an ArrayIndexOutOfBoundsException, instead of a clean SQL error. Either way, a single crafted response can disrupt the thread or the whole JVM running the JDBC client, which matches the availability-only impact in the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, 4.3).

Mitigation

MySQL Connector/J is maintained by Oracle, which ships fixes only in the current Connector/J release line; older lines no longer receive updates. For more information, see the MySQL Product Support EOL Announcements.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of MySQL Connector/J.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.