Cloudanix VulnDB

CVE-2026-119277

Medium · 5.9

CVSS

5.9

EPSS

0.4%

Published

Oct 29, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Java software that connects applications to MariaDB or MySQL databases can let a bad server cause those connections to crash, interrupting normal database work.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Packet decoders in the connector fail to validate server-supplied lengths against the actual receive buffer, allowing reads, sub-buffer creation, or string decoding past packet boundaries and triggering unhandled ArrayIndexOutOfBoundsException or IllegalArgumentException that aborts JDBC call processing.

Why it matters to the business

Applications using the connector can experience abrupt connection drops and failed database operations when talking to a malicious or compromised server, increasing operational disruption risk; the issue is two days old with low and stable exploit probability and no known ransomware use.

How an attack unfolds

An attacker positioned as a malicious MariaDB/MySQL server or as a machine-in-the-middle sends a crafted OK, column-definition, or row-data packet whose declared lengths exceed the actual data present; the decoder performs an out-of-bounds access that raises an exception inside a JDBC call, terminating the connection without further impact.

How to fix it

Upgrade MariaDB Connector/J to 3.3.7, 3.4.5, or 3.5.11 (or later) in all Java applications; verify the exact version in dependency manifests and rebuild/redeploy affected services.

How to confirm the fix worked

After upgrade, confirm the connector version string matches a fixed release; run connectivity and query tests against both benign and length-manipulated packets to verify exceptions no longer occur.

Typical attack path

  1. Attacker establishes or intercepts a JDBC connection to a MariaDB/MySQL server
  2. Attacker sends a single malformed packet containing an over-long declared length field
  3. Connector decoder reads beyond the packet buffer and throws an unchecked exception
  4. JDBC call aborts and the connection is closed or left in an unusable state

How to detect it

Review application and JDBC driver logs for sudden ArrayIndexOutOfBoundsException or IllegalArgumentException entries originating from packet-decoding classes during database operations; correlate with connection-reset or abrupt-close events.

What your security team should do

  • Prioritize upgrade of all MariaDB Connector/J instances to the listed fixed versions within the next change window
  • Add dependency scanning to CI pipelines to block builds using versions 3.0.0–3.3.6, 3.4.0–3.4.4, or 3.5.0–3.5.10
  • Monitor outbound database connections for unexpected terminations that coincide with server responses

The record

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities