Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-119280: MariaDB Connector/J may crash during transaction recovery

CVE-2026-119280 · published 6 days ago

Summary

Java applications that use MariaDB Connector/J versions before the fixes trust size information sent by the database when finishing certain multi‑database transactions. A compromised or malicious server could send large or malformed values that cause the driver to allocate too much memory or throw errors, leading to application crashes. Upgrade to the latest connector version to eliminate the risk.

What to do

Update org.mariadb.jdbc:mariadb-java-client to version 3.3.7.
Update org.mariadb.jdbc:mariadb-java-client to version 3.4.5.
Update org.mariadb.jdbc:mariadb-java-client to version 3.5.11.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	mariadb-corporation	mariadb-connector-j	>= 3.0.0, < 3.3.7
Debian:12	debian	mariadb-connector-java	All versions
maven	–	org.mariadb.jdbc:mariadb-java-client	>= 3.0.0, < 3.3.7 >= 3.4.0, < 3.4.5 >= 3.5.0, < 3.5.11 Fix: upgrade to 3.3.7
Ubuntu:18.04:LTS	canonical	mariadb-connector-java	All versions

Original advisory text

MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

References

https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7 URL
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5 URL
https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb439005... Patch
https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b3... Patch
https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd17... Patch
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11 URL
https://security-tracker.debian.org/tracker/CVE-2026-119280 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1192... Vendor Advisory
https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/G... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-119280 Vendor Advisory
https://github.com/advisories/GHSA-4jq2-8v3c-97w8
https://ubuntu.com/security/CVE-2026-119280 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-119280 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-789Memory Allocation with Excessive Size Value

Timeline

Published29 Oct 2026

Updated4 Nov 2026

First seen29 Oct 2026

Sources

CVE-2026-119280 · NVD

CVE-2026-119280 · MITRE

DEBIAN-CVE-2026-119280 · OSV

CVE-2026-119280 · OSV

GHSA-4jq2-8v3c-97w8 · GHSA

UBUNTU-CVE-2026-119280 · OSV

Track software like this

Free during beta