Heap Allocation Vulnerability in MariaDB Connector/J by MariaDB
CVE-2026-119276
5.9MEDIUM
What is CVE-2026-119276?
The MariaDB Connector/J exhibits a vulnerability due to improper handling of server-declared lengths for OK packet info fields when the CLIENT_SESSION_TRACK is negotiated. This allows an attacker to force repeated heap allocations by sending a maliciously constructed OK packet, potentially leading to increased garbage collection pressure or an OutOfMemoryError in the client application. This issue has been addressed in the latest releases, securing applications using this connector.
Affected Version(s)
mariadb-connector-j >= 3.0.0, < 3.3.7 < 3.0.0, 3.3.7
mariadb-connector-j >= 3.4.0, < 3.4.5 < 3.4.0, 3.4.5
mariadb-connector-j >= 3.5.0, < 3.5.11 < 3.5.0, 3.5.11