CVE-2026-119279

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119279", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.064Z", "datePublished": "2026-10-29T20:52:22.903Z", "dateUpdated": "2026-11-03T16:47:49.073Z"}, "containers": {"cna": {"title": "MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths", "problemTypes": [{"descriptions": [{"cweId": "CWE-130", "lang": "en", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10"}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"version": ">= 3.0.0, < 3.3.7", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.5", "status": "affected"}, {"version": ">= 3.5.0, < 3.5.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:52:22.903Z"}, "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10."}], "source": {"advisory": "GHSA-797x-p4mc-jwpm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T16:47:19.574859Z", "id": "CVE-2026-119279", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:47:49.073Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T16:47:19.574859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:47:38.490Z"}}], "cna": {"title": "MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths", "source": {"advisory": "GHSA-797x-p4mc-jwpm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}, {"status": "affected", "version": ">= 3.5.0, < 3.5.10"}]}], "references": [{"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:52:22.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119279", "state": "PUBLISHED", "dateUpdated": "2026-11-03T16:47:49.073Z", "dateReserved": "2026-10-29T18:50:28.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T20:52:22.903Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mariadb-connector-j", "vendor": "mariadb-corporation", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}, {"status": "affected", "version": ">= 3.5.0, < 3.5.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10."}], "id": "CVE-2026-119279", "lastModified": "2026-11-03T17:18:05.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119279", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T16:47:19.574859Z", "version": "2.0.3"}}]}, "published": "2026-10-29T21:17:21.387", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-130"}, {"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via integer truncation in length handling", "id": "2563700", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563700"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-681", "details": ["MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10.", "A flaw was found in MariaDB Connector/J. A malicious or compromised database server, or an attacker intercepting network traffic, can cause a Denial of Service (DoS) by sending crafted responses containing excessively large length values. Because the connector converts these protocol values into signed integers without bounds checking, the values can wrap to negative numbers or trigger oversized memory allocations. This issue causes unhandled exceptions or crashes in client applications during connection handling."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-119279", "package_state": [{"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-29T20:52:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119279\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119279\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10\nhttps://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm"], "statement": "This vulnerability is rated as Moderate because successful exploitation requires an adversary to either compromise the upstream database server or gain a privileged network position to manipulate traffic as a machine-in-the-middle. In typical Red Hat environments, Java enterprise services communicate with database backends across protected internal networks or encrypted channels, reducing exposure to traffic interception. Furthermore, the impact is confined to client-side denial of service through connection crashes or excess memory allocation, presenting no threat to data integrity or confidentiality.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb-corporation"}], "created": "2026-10-29T22:30:12.850145+00:00", "updated": "2026-11-02T14:00:08.958316+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$mariadb-connector-j", "mariadb-corporation", "mariadb-corporation$PRODUCT$mariadb-connector-j"], "weaknesses": ["CWE-130", "CWE-190", "CWE-681"]}