{"id":"CVE-2026-119279","aliases":["GHSA-797x-p4mc-jwpm"],"url":"https://o3.security/vulnerability/CVE-2026-119279","summary":"MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths","details":"## Summary\n\nMariaDB Connector/J narrowed 8-byte length-encoded integers received from the\nserver to `int` without validation. A rogue or MitM server can send a value above\n`Integer.MAX_VALUE` whose truncation becomes a negative or arbitrary length.\n\n## Details\n\nThe protocol encodes lengths as length-encoded integers, whose 8-byte form the\ndecoder (`readLength()` and `readIntLengthEncodedNotNull()`) returned as\n`(int) readLong()`. A value above `Integer.MAX_VALUE` therefore wrapped to a\nnegative or unrelated `int`, used afterwards as a length to size allocations or\nreads, which ended in `NegativeArraySizeException`, out-of-bounds exceptions or\noversized allocations.\n\nThe fix rejects any length-encoded value that does not fit a non-negative `int`\nwith an explicit error.\n\n## Impact\n\nAvailability only: a malicious or compromised server, or a MitM, can crash the\nclient's connection handling with unchecked exceptions or drive oversized\nallocations. Exploitation requires control of the server side of the connection;\nno authentication bypass, confidentiality or integrity impact.\n\n## Credit\n\nReported by fg0x0","published":"2026-10-29T20:52:22.903Z","modified":"2026-10-31T07:05:12.285999865Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","fixedVersion":"3.3.7"},{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","fixedVersion":"3.4.5"},{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","fixedVersion":"3.5.10"}],"fix":{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99","label":"mariadb-corporation/mariadb-connector-j@30d4a88"},"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119279.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119279"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea"},{"type":"PACKAGE","url":"https://github.com/mariadb-corporation/mariadb-connector-j"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-31T07:05:12.285999865Z"}}