CVE-2026-119277

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119277", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.064Z", "datePublished": "2026-10-29T20:49:24.148Z", "dateUpdated": "2026-11-04T01:46:32.988Z"}, "containers": {"cna": {"title": "MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-130", "lang": "en", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"version": ">= 3.0.0, < 3.3.7", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.5", "status": "affected"}, {"version": ">= 3.5.0, < 3.5.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:49:24.148Z"}, "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}], "source": {"advisory": "GHSA-wfxr-v78w-p49r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T01:46:18.646347Z", "id": "CVE-2026-119277", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T01:46:32.988Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119277", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T01:46:18.646347Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T01:46:25.657Z"}}], "cna": {"title": "MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths", "source": {"advisory": "GHSA-wfxr-v78w-p49r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}, {"status": "affected", "version": ">= 3.5.0, < 3.5.11"}]}], "references": [{"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:49:24.148Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119277", "state": "PUBLISHED", "dateUpdated": "2026-11-04T01:46:32.988Z", "dateReserved": "2026-10-29T18:50:28.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T20:49:24.148Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mariadb-connector-j", "vendor": "mariadb-corporation", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}, {"status": "affected", "version": ">= 3.5.0, < 3.5.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}], "id": "CVE-2026-119277", "lastModified": "2026-11-04T02:17:18.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119277", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T01:46:18.646347Z", "version": "2.0.3"}}]}, "published": "2026-10-29T21:17:21.067", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-130"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated packet lengths", "id": "2563690", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563690"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.", "A flaw was found in MariaDB Connector/J. This vulnerability can lead to a Denial of Service (DoS) because packet decoders do not verify that sufficient data remains in the receive buffer before reading server-specified lengths. A compromised database server or an attacker positioned between the client and server can send malformed packets, triggering unexpected exceptions that terminate connection handling."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-119277", "package_state": [{"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-29T20:49:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119277\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119277\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11\nhttps://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r"], "statement": "Red Hat Product Security rates this vulnerability as Moderate severity because successful exploitation requires an adversary to either control the database backend or perform man-in-the-middle traffic interception, and the resulting impact is confined to a client-side denial of service. Typical Red Hat environments deploy database clients within secured network boundaries, limiting an external attacker's ability to inject malformed server responses. Furthermore, triggering the vulnerability only aborts active connections through unhandled client exceptions, posing no risk to host confidentiality or data integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb-corporation"}], "created": "2026-10-29T22:30:12.850586+00:00", "updated": "2026-10-29T22:45:03.510409+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$mariadb-connector-j", "mariadb-corporation", "mariadb-corporation$PRODUCT$mariadb-connector-j"]}