{"id":"CVE-2026-119277","aliases":[],"cve":{"records":[{"id":"CVE-2026-119277","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T18:50:28.064Z","published":"2026-10-29T20:49:24.148Z","modified":"2026-10-29T20:49:24.148Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T20:49:24.148Z"}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-125","description":"CWE-125: Out-of-bounds Read","source":"GitHub_M"},{"id":"CWE-130","description":"CWE-130: Improper Handling of Length Parameter Inconsistency","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","score":5.9,"severity":"medium","published":"2026-10-29T20:49:24.148Z","modified":"2026-10-29T20:49:24.148Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"mariadb-corporation","name":"mariadb-connector-j","platforms":[],"versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119277"}],"remediation":[],"references":["https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r","https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12","https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4","https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"],"sources":[{"name":"CVE","id":"CVE-2026-119277","modified":"2026-10-29T20:49:24.148Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119277"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9}],"sourceAffected":[],"observedAt":"2026-10-29T21:32:53.582Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:00:31.629Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T02:10:32.092Z","attemptedAt":"2026-10-30T02:10:32.092Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T02:10:32.092Z","attemptedAt":"2026-10-30T02:10:32.092Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T02:10:31.640Z","attemptedAt":"2026-10-30T02:10:31.640Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T02:10:31.624Z","attemptedAt":"2026-10-30T02:10:31.624Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113384","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113384","modified":"Oct 29, 2026, 8:49:24 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T02:10:31.640Z"},{"source":"NVD","id":"CVE-2026-119277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119277","modified":"2026-10-29T21:17:21.067","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T02:10:32.092Z"}],"aiSummary":{"text":"MariaDB Connector/J versions 3.0.0 to 3.3.7, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.11 are affected by a vulnerability where a rogue server can cause the client to read past the packet boundary. A malicious server or man-in-the-middle attacker can trigger failures. The issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:44:42.106Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119277"}]}}