CVE-2026-119277

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Metrics

CVSS 3.1

5.9 (MEDIUM) Score source: CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — exploit probability

0% (percentile: 29) as of 1 November 2026

CWE

CWE-125, CWE-130

References

• https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816…
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db…
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50…
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11
• https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/…