Rogue server can cause out-of-bounds reads in MariaDB Connector/J
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
MariaDB Connector/J from 3.0.0 before 3.3.7, from 3.4.0 before 3.4.5, and from 3.5.0 before 3.5.11 is affected. Decoders for OK packet session-state blocks, column definition packets, and text or binary row data use server-declared lengths without checking that the requested bytes remain in the receive buffer, which is an out-of-bounds read (CWE-125). A malicious or compromised server, or a machine-in-the-middle attacker, can trigger unchecked exceptions that terminate connection handling.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MariaDB | mariadb-connector-j | 3.0.0 to before 3.3.7; 3.4.0 to before 3.4.5; 3.5.0 to before 3.5.11 | 3.3.7, 3.4.5, 3.5.11 | Patch available | CNA |
- mariadb-connector-j VendorMariaDB Affected 3.0.0 to before 3.3.7; 3.4.0 to before 3.4.5; 3.5.0 to before 3.5.11 Fixed in 3.3.7, 3.4.5, 3.5.11 Patch available CNA
Remediation
Upgrade MariaDB Connector/J to version 3.3.7, 3.4.5, or 3.5.11. Red Hat lists no available fix for Red Hat Build of Keycloak, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat build of Debezium 3 and Red Hat build of Quarkus, and no fix planned for Red Hat OpenStack Platform 13 (Queens).
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA mariadb-connector-j (mariadb-corporation) Fixed in 3.3.7, 3.4.5, 3.5.11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119277
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CISA SSVC decision points changed
References
Other 7
- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11
More MariaDB vulnerabilities
- TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
- TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
- TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
- TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
- TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
- TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
Sources
- CVE-2026-119277 · CVE Program
- CVE-2026-119277 · NVD
- FIRST EPSS
- CVE-2026-119277 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences