Vulnerability in MariaDB Connector/J Affects Java Applications
CVE-2026-119280
What is CVE-2026-119280?
The MariaDB Connector/J, utilized for establishing connections between Java applications and both MariaDB and MySQL databases, contains a vulnerability in versions 3.0.0 to 3.3.7, 3.4.5, and 3.5.11. The implementation of the methods MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() incorrectly trusts the length values of gtrid_length and bqual_length returned by XA RECOVER. This flawed trust leads to potential memory allocation issues, such as NegativeArraySizeException or ArrayIndexOutOfBoundsException, if a malicious server or an attacker positioned on the communication path exploits this vulnerability. The issue has been addressed in the later versions, ensuring the lengths are properly validated against predefined limits prior to allocation.
Affected Version(s)
mariadb-connector-j >= 3.0.0, < 3.3.7 < 3.0.0, 3.3.7
mariadb-connector-j >= 3.4.0, < 3.4.5 < 3.4.0, 3.4.5
mariadb-connector-j >= 3.5.0, < 3.5.11 < 3.5.0, 3.5.11