CVE-2026-119280lowCWE-20CWE-789

CVE-2026-119280: fallo de gravedad baja en mariadb-corporation mariadb-connector-j

MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear mariadb-connector-j+ Monitorear org.mariadb.jdbc:mariadb-java-client

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7epss 0.3%
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
mariadb-corporation · mariadb-connector-j
CVEs relacionadas — mariadb-corporation mariadb-connector-j

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-55858MEDIUMMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientEPSS 0.9%CVE-2026-55856MEDIUMMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeEPSS 0.4%CVE-2026-55857MEDIUMMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsEPSS 0.4%CVE-2026-61700LOWMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsEPSS 0.4%CVE-2026-119278MEDIUMMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationEPSS 0.4%CVE-2026-119279MEDIUMMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsEPSS 0.4%