CVE-2026-119279

What it actually does

The flaw in ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() casts an unsigned 64-bit length-encoded integer directly to a signed Java int without range validation, allowing values exceeding Integer.MAX_VALUE to wrap around and produce negative or invalid lengths that downstream buffer allocation and read operations then consume.

Why it matters to the business

Applications using the connector may experience sudden connection failures or crashes when communicating with a malicious database server, leading to service disruption for Java-based database workloads; the issue was publicly disclosed only two days ago with no known active exploitation yet.

How an attack unfolds

An attacker who controls a MariaDB or MySQL server response or who can perform a man-in-the-middle attack on the connection sends a length-encoded integer larger than Integer.MAX_VALUE; the client library performs an unchecked narrowing conversion that yields a negative size, triggering NegativeArraySizeException, out-of-bounds access, or excessive memory allocation during connection handshake handling.

How to fix it

Upgrade MariaDB Connector/J to version 3.3.7, 3.4.5, or 3.5.10 or later; verify the updated JAR is deployed in all Java application classpaths and restart affected services.

How to confirm the fix worked

Confirm the connector JAR version string matches a fixed release; attempt to reproduce the issue by sending an oversized length-encoded integer in a controlled test environment and verify that NegativeArraySizeException no longer occurs.

Typical attack path

1. Position as a malicious or compromised database server or intercept client traffic via MITM
2. Return a protocol length-encoded integer exceeding 2^31-1 during connection or result-set handling
3. Client performs unchecked cast to Java int producing a negative or unrelated length value
4. Downstream allocation or read path consumes the invalid length, resulting in exception or memory corruption

How to detect it

Search Java application and connector logs for NegativeArraySizeException or related buffer allocation failures occurring during database connection establishment; correlate with inbound server responses containing unexpectedly large length fields.

• NegativeArraySizeException
• ReadableByteBuf.readLength
• ReadableByteBuf.readIntLengthEncodedNotNull

What your security team should do

• Immediately upgrade all instances of MariaDB Connector/J to the fixed releases
• Review application logs for NegativeArraySizeException or buffer-related errors on database connections
• Apply network segmentation or TLS pinning to reduce MITM exposure until upgrades are complete