{"id":"CVE-2026-119276","aliases":["GHSA-h599-m3w5-9m7x"],"title":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","summary":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","severity":"medium","cvss":5.9,"cwe":["CWE-130","CWE-789"],"vendor":"mariadb","product":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"maven","affected":["org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7","org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5","org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.11"],"patched":["org.mariadb.jdbc:mariadb-java-client 3.3.7","org.mariadb.jdbc:mariadb-java-client 3.4.5","org.mariadb.jdbc:mariadb-java-client 3.5.11"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T23:00:14Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-h599-m3w5-9m7x","references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119276"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"},{"url":"https://github.com/advisories/GHSA-h599-m3w5-9m7x"}],"tags":["ghsa","maven"],"epss":0.00351,"epssPercentile":0.28744,"ingestedAt":"2026-10-30T23:11:25.780Z","slug":"CVE-2026-119276","body":"## Overview\n\n## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session state at the first inconsistent\nentry.\n\n## Impact\n\nAvailability only: a malicious or compromised server, or a MitM, can drive\nattacker-controlled heap allocations on every OK packet, creating GC pressure up to\n`OutOfMemoryError` in the client application. Exploitation requires control of the\nserver side of the connection; no authentication bypass, confidentiality or\nintegrity impact.\n\n## Credit\n\nReported by fg0x0\n\n## Affected packages\n\n- `org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7`\n- `org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5`\n- `org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.mariadb.jdbc:mariadb-java-client 3.3.7`\n- `org.mariadb.jdbc:mariadb-java-client 3.4.5`\n- `org.mariadb.jdbc:mariadb-java-client 3.5.11`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}