CVE-2026-119280Low· 3.7▾ SunlitMariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and
bqual_length columns returned by XA RECOVER to allocate and split each Xid.
MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of
the recovery list by allocating new byte[gtrid_length] and
new byte[bqual_length] and copying from the data column, without validating
the lengths against the XA specification bounds (Xid.MAXGTRIDSIZE,
Xid.MAXBQUALSIZE) or the actual payload. Negative or oversized lengths, or
lengths that do not fit the data, ended in large allocations or unchecked
exceptions (NegativeArraySizeException, ArrayIndexOutOfBoundsException)
during recovery.
The fix validates the lengths before any allocation or copy and reports an
invalid row as an XAException (XAER_RMFAIL).
Availability only, and limited to applications running XA recovery: a malicious or compromised server, or a MitM, can crash the recovery or drive large allocations. Exploitation requires control of the server side of the connection.
Reported by fg0x0
org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.11Upgrade to a patched release:
org.mariadb.jdbc:mariadb-java-client 3.3.7org.mariadb.jdbc:mariadb-java-client 3.4.5org.mariadb.jdbc:mariadb-java-client 3.5.11Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119210Medium· 5.9MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files
CVE-2026-119276Medium· 5.9MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
CVE-2026-119281Medium· 5.9MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
CVE-2026-119279Medium· 5.9MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
CVE-2026-55856Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
CVE-2026-55857Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases