Buffer Overflow Vulnerability in MariaDB Connector/J Affects Java Applications
CVE-2026-119277
What is CVE-2026-119277?
The MariaDB Connector/J, utilized for Java applications connecting to MariaDB and MySQL databases, is vulnerable due to improper handling of server-declared lengths in packet decoders. The issue arises from the decoders' failure to verify the presence of requested bytes in the receive buffer. This oversight can result in the decoders attempting to position reads, create sub-buffers, or decode strings beyond the valid packet boundaries. A malicious server or a man-in-the-middle attacker could exploit this vulnerability, leading to unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException crashes during JDBC calls. To mitigate this, it is essential to update to the fixed versions: 3.3.7, 3.4.5, or 3.5.11.
Affected Version(s)
mariadb-connector-j >= 3.0.0, < 3.3.7 < 3.0.0, 3.3.7
mariadb-connector-j >= 3.4.0, < 3.4.5 < 3.4.0, 3.4.5
mariadb-connector-j >= 3.5.0, < 3.5.11 < 3.5.0, 3.5.11