CVE-2026-119280

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119280", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.064Z", "datePublished": "2026-10-29T20:55:50.101Z", "dateUpdated": "2026-10-30T17:10:10.174Z"}, "containers": {"cna": {"title": "MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"version": ">= 3.0.0, < 3.3.7", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.5", "status": "affected"}, {"version": ">= 3.5.0, < 3.5.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:55:50.101Z"}, "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}], "source": {"advisory": "GHSA-4jq2-8v3c-97w8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T17:09:58.150194Z", "id": "CVE-2026-119280", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:10:10.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths", "source": {"advisory": "GHSA-4jq2-8v3c-97w8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mariadb-corporation", "product": "mariadb-connector-j", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}, {"status": "affected", "version": ">= 3.5.0, < 3.5.11"}]}], "references": [{"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11", "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T20:55:50.101Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:09:58.150194Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-30T17:10:06.576Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-119280", "state": "PUBLISHED", "dateUpdated": "2026-10-29T20:55:50.101Z", "dateReserved": "2026-10-29T18:50:28.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T20:55:50.101Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mariadb-connector-j", "vendor": "mariadb-corporation", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}, {"status": "affected", "version": ">= 3.5.0, < 3.5.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}], "id": "CVE-2026-119280", "lastModified": "2026-10-30T17:18:03.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119280", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T17:09:58.150194Z", "version": "2.0.3"}}]}, "published": "2026-10-29T21:17:21.553", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "id": "2563694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563694"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-130", "details": ["A flaw was found in MariaDB Connector/J. A malicious database server or an attacker intercepting network traffic can trigger a Denial of Service (DoS) by returning crafted transaction identifier lengths during distributed transaction (XA) recovery. Because the connector does not validate these length values against allowed limits or the incoming data payload, processing the response can cause excessive memory allocations or unhandled exceptions that crash the client application."], "name": "CVE-2026-119280", "package_state": [{"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb-java-client", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-29T20:55:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119280\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119280\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47\nhttps://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5\nhttps://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11\nhttps://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mariadb-connector-j", "source": "cna", "vendor": "mariadb-corporation"}, "product": "mariadb-connector-j", "vendor": "mariadb-corporation"}], "created": "2026-10-29T22:30:12.849887+00:00", "updated": "2026-10-30T14:00:17.114159+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$mariadb-connector-j", "mariadb-corporation", "mariadb-corporation$PRODUCT$mariadb-connector-j"], "weaknesses": ["CWE-130", "CWE-20", "CWE-789"]}