{"id":"CVE-2026-119276","aliases":["GHSA-h599-m3w5-9m7x"],"title":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session state at the first inconsistent\nentry.\n\n## Impact\n\nAvailability only: a malicious or compromised server, or a MitM, can drive\nattacker-controlled heap allocations on every OK packet, creating GC pressure up to\n`OutOfMemoryError` in the client application. Exploitation requires control of the\nserver side of the connection; no authentication bypass, confidentiality or\nintegrity impact.\n\n## Credit\n\nReported by fg0x0","severity":"medium","score":5.9,"published":"2026-10-29T20:47:32.086Z","modified":"2026-10-30T23:15:06.518Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","sources":[{"name":"OSV · GHSA-h599-m3w5-9m7x","url":"https://osv.dev/vulnerability/GHSA-h599-m3w5-9m7x"}],"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.3.7"}],"type":"ECOSYSTEM"}],"versions":["3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6"],"fixed":["3.3.7"]},{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","sources":[{"name":"OSV · GHSA-h599-m3w5-9m7x","url":"https://osv.dev/vulnerability/GHSA-h599-m3w5-9m7x"}],"ranges":[{"events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}],"type":"ECOSYSTEM"}],"versions":["3.4.0","3.4.1","3.4.2","3.4.3","3.4.4"],"fixed":["3.4.5"]},{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","sources":[{"name":"OSV · GHSA-h599-m3w5-9m7x","url":"https://osv.dev/vulnerability/GHSA-h599-m3w5-9m7x"}],"ranges":[{"events":[{"introduced":"3.5.0"},{"fixed":"3.5.11"}],"type":"ECOSYSTEM"}],"versions":["3.5.0","3.5.1","3.5.10","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"],"fixed":["3.5.11"]}],"sourceAffected":[],"references":["https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x","https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f","https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6","https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","https://nvd.nist.gov/vuln/detail/CVE-2026-119276","https://github.com/mariadb-corporation/mariadb-connector-j"],"sources":[{"name":"CVE","id":"CVE-2026-119276","modified":"2026-10-30T17:11:51.081Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119276"},{"name":"OSV","id":"GHSA-h599-m3w5-9m7x","modified":"2026-10-30T23:15:06.518147727Z","url":"https://osv.dev/vulnerability/GHSA-h599-m3w5-9m7x"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9}],"cve":{"records":[{"id":"CVE-2026-119276","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T18:50:28.064Z","published":"2026-10-29T20:47:32.086Z","modified":"2026-10-30T17:11:51.081Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T20:47:32.086Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:11:51.081Z"}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-130","description":"CWE-130: Improper Handling of Length Parameter Inconsistency","source":"GitHub_M"},{"id":"CWE-789","description":"CWE-789: Memory Allocation with Excessive Size Value","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:11:37.642004Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"mariadb-corporation","name":"mariadb-connector-j","platforms":[],"versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119276"}],"remediation":[],"observedAt":"2026-10-30T23:32:31.658Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T02:10:36.466Z","attemptedAt":"2026-10-30T02:10:36.466Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T02:10:37.290Z","attemptedAt":"2026-10-30T02:10:37.290Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T02:10:37.214Z","attemptedAt":"2026-10-30T02:10:37.214Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T02:10:35.243Z","attemptedAt":"2026-10-30T02:10:35.243Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119276","modified":"2026-10-29T21:17:20.907","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T02:10:36.466Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113383","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113383","modified":"Oct 29, 2026, 8:47:32 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T02:10:37.214Z"}],"aiSummary":null}