CVE-2026-119278

What it actually does

During caching_sha2_password authentication the connector allocates memory based on a server-supplied length and reads authResult[0] without validating presence of any byte, allowing excessive allocation or an uncaught ArrayIndexOutOfBoundsException to propagate from DriverManager.getConnection().

Why it matters to the business

Java applications that connect to MariaDB or MySQL may experience sudden crashes or resource exhaustion when a malicious server or network attacker supplies a malformed authentication response, interrupting database-dependent services.

How an attack unfolds

An attacker positioned as a man-in-the-middle or controlling a malicious MariaDB/MySQL server intercepts the authentication exchange, responds to the caching_sha2_password request with either an extremely large declared length or an empty packet, and triggers either massive memory allocation or an unhandled exception that terminates the client connection attempt.

How to fix it

Upgrade MariaDB Connector/J to version 3.3.7 or 3.4.5 (or later) in all affected branches; rebuild and redeploy applications with the updated driver; verify the new driver version appears in dependency manifests.

How to confirm the fix worked

Confirm the Connector/J jar or Maven/Gradle dependency reports version 3.3.7 or 3.4.5; execute a test connection against a server that returns a zero-length auth response and verify no exception or excessive allocation occurs.

Typical attack path

1. Establish network position as MITM or compromised database server
2. Wait for client to initiate caching_sha2_password authentication
3. Send authentication-more-data packet declaring an oversized length or containing zero bytes
4. Observe client allocate excessive memory or throw ArrayIndexOutOfBoundsException from DriverManager.getConnection()

How to detect it

Search application and JVM logs for ArrayIndexOutOfBoundsException thrown during DriverManager.getConnection calls involving caching_sha2_password; inspect heap dumps or GC logs for sudden large allocations immediately after authentication responses; correlate with network captures showing oversized or empty auth packets from the database server.

• ArrayIndexOutOfBoundsException
• authResult
• caching_sha2_password
• DriverManager.getConnection

What your security team should do

• Prioritize upgrade of MariaDB Connector/J to 3.3.7 or 3.4.5 within the next maintenance window
• Scan all Java projects and containers for vulnerable driver versions (3.0.0 through 3.3.6 and 3.4.0-3.4.4)
• Add dependency-version enforcement in build pipelines to prevent reintroduction of older releases
• Monitor application logs for ArrayIndexOutOfBoundsException originating from the MariaDB driver