CVE-2026-119278

Overview

MariaDB Connector/J is MariaDB's JDBC driver: a JDBC 4.2 compatible driver used to connect applications developed in Java to MariaDB and MySQL databases. It is published to Maven Central as org.mariadb.jdbc:mariadb-java-client, and Spring Boot 2.7.18 manages its 3.1.4 release.

A denial of service vulnerability (CVE-2026-119278) has been identified in the caching_sha2_password authentication plugin of MariaDB Connector/J, which allows a malicious or compromised database server, or a man-in-the-middle, to crash the client's connection attempt or force it to allocate a very large amount of memory. This happens before the client sends its password, so no credential is exposed.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of MariaDB Connector/J.

Details

Module Info

• Product: MariaDB Connector/J
• Affected packages: org.mariadb.jdbc:mariadb-java-client
• Affected versions: >=3.0.0 <3.3.7, >=3.4.0 <3.4.5
• GitHub repository: https://github.com/mariadb-corporation/mariadb-connector-j
• Published packages: https://central.sonatype.com/artifact/org.mariadb.jdbc/mariadb-java-client
• Package manager: Maven
• Fixed in:
  • OSS MariaDB Connector/J 3.3.7, 3.4.5
  • NES for MariaDB Connector/J v3.1.7

Vulnerability Info

This Medium-severity vulnerability is found in the org.mariadb.jdbc:mariadb-java-client package in multiple versions of MariaDB Connector/J.

When a connection authenticates with caching_sha2_password, CachingSha2PasswordPlugin.process() sends the scrambled password hash and reads the server's reply. The fast authentication result in that reply is a single byte: 0x03 when fast authentication succeeded and 0x04 when full authentication is required. The plugin does not read it as one byte. It reads a length-encoded integer from the packet, allocates a byte array of that size, copies the packet into it and switches on its first element:

default:
  // fast authentication result
  byte[] authResult = new byte[buf.readIntLengthEncodedNotNull()];
  buf.readBytes(authResult);
  switch (authResult[0]) {
    case 3:
      return in.readReusablePacket();
    case 4:

The length is whatever the server declares. With a 0xFE prefix, readIntLengthEncodedNotNull() reads an 8-byte length and casts it to int, so a nine-byte packet can make the driver try to allocate about 2 GB. A packet whose declared length does not match its contents, or an empty one, makes the array read fail. Either way the failure is an unchecked exception or an OutOfMemoryError thrown out of DriverManager.getConnection() rather than a SQLException, before any password has been sent.

When full authentication is required, the connection is not over TLS and the client retrieves the server's RSA public key, the plugin also skips the first byte of the key packet without checking that it is the expected 0x01 prefix:

default:
  // AuthMoreData packet
  buf.skip();
  byte[] authMoreData = new byte[buf.readableBytes()];
  buf.readBytes(authMoreData);
  publicKey = generatePublicKey(authMoreData);

Exploitation needs control of the server side of the connection: a rogue server the application is pointed at, or a man-in-the-middle on a connection that is not protected by verified TLS. The impact is limited to availability.

Mitigation

MariaDB plc's Engineering Policy lists MariaDB Connector/J 2.7, 3.3, 3.4 and 3.5 as its supported release series. Upstream has made no 3.1.x release since 3.1.4 (April 2023), so no 3.1.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of MariaDB Connector/J that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• shadow043 (Anesh083) (finder)