CVE-2026-119276

Overview

MariaDB Connector/J is MariaDB's JDBC driver: a JDBC 4.2 compatible driver used to connect applications developed in Java to MariaDB and MySQL databases. It is published to Maven Central as org.mariadb.jdbc:mariadb-java-client, and Spring Boot 2.7.18 manages its 3.1.4 release.

A denial of service vulnerability (CVE-2026-119276) has been identified in the protocol packet parsing of MariaDB Connector/J, which allows a malicious or compromised database server, or a machine-in-the-middle attacker, to make the client allocate large heap buffers from very small packets. Repeated allocations can create garbage-collection pressure up to an OutOfMemoryError in the client application.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects multiple versions of MariaDB Connector/J.

Details

Module Info

• Product: MariaDB Connector/J
• Affected packages: org.mariadb.jdbc:mariadb-java-client
• Affected versions: >=3.0.0 <3.3.7, >=3.4.0 <3.4.5, >=3.5.0 <3.5.11
• GitHub repository: https://github.com/mariadb-corporation/mariadb-connector-j
• Published packages: https://central.sonatype.com/artifact/org.mariadb.jdbc/mariadb-java-client
• Package manager: Maven
• Fixed in:
  • OSS MariaDB Connector/J 3.3.7, 3.4.5, 3.5.11
  • NES for MariaDB Connector/J v3.1.7

Vulnerability Info

This Medium-severity vulnerability is found in the org.mariadb.jdbc:mariadb-java-client package in multiple versions of MariaDB Connector/J. The MariaDB protocol encodes many fields as a length followed by that many bytes. The driver read these server-declared lengths and allocated a byte[] of that size before checking that the packet actually held that many bytes. The copy that followed failed once it ran past the end of the packet, but only after the allocation had already happened.

Several parsing paths follow this pattern, and which ones are present depends on the release line. In the 3.5 line, OkPacket.parse() and parseWithInfo() allocate buffers for each session-state variable name and value when CLIENT_SESSION_TRACK is negotiated, which is the default, and parseWithInfo() in the 3.4 and 3.5 lines allocates the OK packet info field the same way. In 3.1.4, the reachable allocations come from column definitions and result rows. For example, 3.1.4's StandardReadableByteBuf.readLengthBuffer(), which ColumnDecoder.decode() uses to read extended type metadata from a column definition, sizes its buffer from the declared length alone:

public StandardReadableByteBuf readLengthBuffer() {
  int len = this.readIntLengthEncodedNotNull();
  byte[] tmp = new byte[len];
  readBytes(tmp);
  return new StandardReadableByteBuf(tmp, len);
}

Row field lengths are handled the same way. TextRowDecoder returns the 4-byte length from a 0xFE length prefix unchanged, and string, binary, bit and geometry decoders such as ByteArrayCodec then allocate it directly:

byte[] arr = new byte[length.get()];
buf.readBytes(arr);
return arr;

Because these declared lengths are valid positive integers, the existing integer-range checks on length-encoded values do not reject them. A server that declares an 8 MiB length in an 18-byte packet makes the client allocate 8 MiB, and it can repeat this on every packet the client parses. The impact is limited to availability: the attacker must control the server side of the connection, and no confidentiality or integrity impact results.

Mitigation

MariaDB plc's Engineering Policy lists MariaDB Connector/J 2.7, 3.3, 3.4 and 3.5 as its supported release series. Upstream has made no 3.1.x release since 3.1.4 (April 2023), so no 3.1.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of MariaDB Connector/J that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• fg0x0 (finder)