{"id":"CVE-2026-119279","aliases":["GHSA-797x-p4mc-jwpm"],"title":"MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths","summary":"MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths","severity":"medium","cvss":5.9,"cwe":["CWE-130","CWE-190"],"vendor":"mariadb","product":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"maven","affected":["org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7","org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5","org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.10"],"patched":["org.mariadb.jdbc:mariadb-java-client 3.3.7","org.mariadb.jdbc:mariadb-java-client 3.4.5","org.mariadb.jdbc:mariadb-java-client 3.5.10"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T23:00:08Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-797x-p4mc-jwpm","references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119279"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10"},{"url":"https://github.com/advisories/GHSA-797x-p4mc-jwpm"}],"tags":["ghsa","maven"],"epss":0.00351,"epssPercentile":0.28744,"ingestedAt":"2026-10-30T23:11:25.781Z","slug":"CVE-2026-119279","body":"## Overview\n\n## Summary\n\nMariaDB Connector/J narrowed 8-byte length-encoded integers received from the\nserver to `int` without validation. A rogue or MitM server can send a value above\n`Integer.MAX_VALUE` whose truncation becomes a negative or arbitrary length.\n\n## Details\n\nThe protocol encodes lengths as length-encoded integers, whose 8-byte form the\ndecoder (`readLength()` and `readIntLengthEncodedNotNull()`) returned as\n`(int) readLong()`. A value above `Integer.MAX_VALUE` therefore wrapped to a\nnegative or unrelated `int`, used afterwards as a length to size allocations or\nreads, which ended in `NegativeArraySizeException`, out-of-bounds exceptions or\noversized allocations.\n\nThe fix rejects any length-encoded value that does not fit a non-negative `int`\nwith an explicit error.\n\n## Impact\n\nAvailability only: a malicious or compromised server, or a MitM, can crash the\nclient's connection handling with unchecked exceptions or drive oversized\nallocations. Exploitation requires control of the server side of the connection;\nno authentication bypass, confidentiality or integrity impact.\n\n## Credit\n\nReported by fg0x0\n\n## Affected packages\n\n- `org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7`\n- `org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5`\n- `org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.mariadb.jdbc:mariadb-java-client 3.3.7`\n- `org.mariadb.jdbc:mariadb-java-client 3.4.5`\n- `org.mariadb.jdbc:mariadb-java-client 3.5.10`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}