{"id":"CVE-2026-119276","aliases":["GHSA-h599-m3w5-9m7x"],"url":"https://o3.security/vulnerability/CVE-2026-119276","summary":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","details":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session state at the first inconsistent\nentry.\n\n## Impact\n\nAvailability only: a malicious or compromised server, or a MitM, can drive\nattacker-controlled heap allocations on every OK packet, creating GC pressure up to\n`OutOfMemoryError` in the client application. Exploitation requires control of the\nserver side of the connection; no authentication bypass, confidentiality or\nintegrity impact.\n\n## Credit\n\nReported by fg0x0","published":"2026-10-29T20:47:32.086Z","modified":"2026-10-31T07:05:14.662988516Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","fixedVersion":"3.3.7"},{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","fixedVersion":"3.4.5"},{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","fixedVersion":"3.5.11"}],"fix":{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f","label":"mariadb-corporation/mariadb-connector-j@b9e1ee8"},"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119276.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119276"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56"},{"type":"PACKAGE","url":"https://github.com/mariadb-corporation/mariadb-connector-j"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-31T07:05:14.662988516Z"}}