CVE-2026-119278

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119278", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.064Z", "datePublished": "2026-10-29T20:50:35.474Z", "dateUpdated": "2026-10-30T16:00:11.050Z"}, "containers": {"cna": {"title": "MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"version": ">= 3.0.0, < 3.3.7", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:50:35.474Z"}, "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5."}], "source": {"advisory": "GHSA-r9vh-xh4r-j6gr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:20:41.784215Z", "id": "CVE-2026-119278", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:00:11.050Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication", "source": {"advisory": "GHSA-r9vh-xh4r-j6gr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}]}], "references": [{"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:50:35.474Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T15:20:41.784215Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-30T15:20:42.642Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-119278", "state": "PUBLISHED", "dateUpdated": "2026-10-29T20:50:35.474Z", "dateReserved": "2026-10-29T18:50:28.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T20:50:35.474Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mariadb-connector-j", "vendor": "mariadb-corporation", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5."}], "id": "CVE-2026-119278", "lastModified": "2026-10-30T17:07:53.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119278", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:20:41.784215Z", "version": "2.0.3"}}]}, "published": "2026-10-29T21:17:21.237", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via malformed authentication response", "id": "2563698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563698"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5.", "A flaw was found in MariaDB Connector/J. A malicious server or an attacker intercepting network traffic can exploit this vulnerability by sending a malformed authentication response during the connection handshake. Because the driver does not properly validate the response structure, this issue can trigger excessive memory allocation or an unhandled crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-119278", "package_state": [{"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-29T20:50:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119278\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119278\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5\nhttps://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr"], "statement": "Red Hat has evaluated this vulnerability as having a Moderate impact because successful exploitation requires high attack complexity, necessitating either a rogue database server or a machine-in-the-middle network interception of the connection handshake. In typical Red Hat deployments, enterprise Java applications communicate with trusted backend databases across secured, isolated network segments, limiting opportunities for traffic tampering. Furthermore, the issue only affects connections using the caching_sha2_password authentication plugin and causes client-side connection failure or resource exhaustion without compromising system confidentiality or data integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb-corporation"}], "created": "2026-10-29T22:30:12.850378+00:00", "updated": "2026-11-02T13:30:17.907688+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$mariadb-connector-j", "mariadb-corporation", "mariadb-corporation$PRODUCT$mariadb-connector-j"]}