MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
Impact
MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the packet. A rogue or MitM server can make the client allocate megabytes from a packet of a few bytes.
Source excerpt · OSVExploitation requires control of the server side of the connection; no authentication bypass, confidentiality or integrity impact.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 3.0.0 before 3.3.7Ecosystem versions | 3.3.7 |
| From 3.4.0 before 3.4.5Ecosystem versions | 3.4.5 |
| From 3.5.0 before 3.5.11Ecosystem versions | 3.5.11 |
Version evidence: OSV · GHSA-h599-m3w5-9m7x
View original version evidence (40 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
mariadb-corporation · GitHub_M
mariadb-connector-j
3 ranges
mariadb-corporation · GitHub_M
mariadb-connector-j
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 3.0.0, < 3.3.7
>= 3.4.0, < 3.4.5
>= 3.5.0, < 3.5.11
Other versions: unknown
Original source description
Summary
MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the packet. A rogue or MitM server can make the client allocate megabytes from a packet of a few bytes.
Details
When CLIENT_SESSION_TRACK is negotiated (the default), an OK packet carries an
info field followed by session-state blocks, each tracked variable being sent as a
length-encoded name and value. OkPacket.parse() and parseWithInfo() allocated
new byte[len] for the info field, the variable name and the value with the
server-declared len, then copied the packet data into it. The copy failed with an
ArrayIndexOutOfBoundsException when the packet was shorter, but only after the
allocation had taken place.
A server-declared length of 8 MiB in an 18-byte packet was enough to trigger an 8 MiB allocation; the integer-range validation of length-encoded values does not help, since such lengths are valid positive integers.
The fix validates every server-declared length against the remaining packet bytes
before any allocation (ReadableByteBuf.checkLength() and a bounded
readBytes(int)), and stops reading the session state at the first inconsistent
entry.
Impact
Availability only: a malicious or compromised server, or a MitM, can drive
attacker-controlled heap allocations on every OK packet, creating GC pressure up to
OutOfMemoryError in the client application. Exploitation requires control of the
server side of the connection; no authentication bypass, confidentiality or
integrity impact.
Credit
Reported by fg0x0
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-119276View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-119276
Observed 2026-10-30T18:55:56.779Z · upstream updated 2026-10-30T17:11:51.081Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T17:11:37.642004Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.