CVE-2026-119280lowCWE-20CWE-789

CVE-2026-119280: falha de baixa gravidade em mariadb-corporation mariadb-connector-j

MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mariadb-connector-j+ Monitorar org.mariadb.jdbc:mariadb-java-client

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.7epss 0.3%
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
mariadb-corporation · mariadb-connector-j
CVEs relacionadas — mariadb-corporation mariadb-connector-j

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55858MEDIUMMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientEPSS 0.9%CVE-2026-55856MEDIUMMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeEPSS 0.4%CVE-2026-55857MEDIUMMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsEPSS 0.4%CVE-2026-61700LOWMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsEPSS 0.4%CVE-2026-119278MEDIUMMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationEPSS 0.4%CVE-2026-119279MEDIUMMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsEPSS 0.4%