MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths
Impact
XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and bqual_length columns returned by XA RECOVER to allocate and split each Xid.
Source excerpt · OSVExploitation requires control of the server side of the connection.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 3.0.0 before 3.3.7Ecosystem versions | 3.3.7 |
| From 3.4.0 before 3.4.5Ecosystem versions | 3.4.5 |
| From 3.5.0 before 3.5.11Ecosystem versions | 3.5.11 |
Version evidence: OSV · GHSA-4jq2-8v3c-97w8
View original version evidence (40 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
mariadb-corporation · GitHub_M
mariadb-connector-j
3 ranges
mariadb-corporation · GitHub_M
mariadb-connector-j
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 3.0.0, < 3.3.7
>= 3.4.0, < 3.4.5
>= 3.5.0, < 3.5.11
Other versions: unknown
Original source description
Summary
XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and
bqual_length columns returned by XA RECOVER to allocate and split each Xid.
Details
MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of
the recovery list by allocating new byte[gtrid_length] and
new byte[bqual_length] and copying from the data column, without validating
the lengths against the XA specification bounds (Xid.MAXGTRIDSIZE,
Xid.MAXBQUALSIZE) or the actual payload. Negative or oversized lengths, or
lengths that do not fit the data, ended in large allocations or unchecked
exceptions (NegativeArraySizeException, ArrayIndexOutOfBoundsException)
during recovery.
The fix validates the lengths before any allocation or copy and reports an
invalid row as an XAException (XAER_RMFAIL).
Impact
Availability only, and limited to applications running XA recovery: a malicious or compromised server, or a MitM, can crash the recovery or drive large allocations. Exploitation requires control of the server side of the connection.
Credit
Reported by fg0x0
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-119280View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-119280
Observed 2026-10-30T18:55:58.441Z · upstream updated 2026-10-30T17:10:10.174Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T17:09:58.150194Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.