CVE-2026-119280

What it actually does

The recover() methods in MariaDbPoolConnection and MariaDbPoolPinnedConnection allocate and split Xid byte arrays based on untrusted gtrid_length and bqual_length values returned by XA RECOVER without bounds checks against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or payload size, enabling excessive memory allocation or out-of-bounds access exceptions.

Why it matters to the business

Applications using the connector for XA transactions may experience crashes or degraded availability when connected to a malicious, compromised, or intercepted database server, requiring restarts and potentially disrupting transaction processing with low but non-zero operational impact given the recent publication and stable low exploit probability.

How an attack unfolds

An attacker positions themselves as a malicious or compromised MariaDB/MySQL server or performs a machine-in-the-middle attack on the connection; during XA recovery the server returns crafted XA RECOVER responses with oversized or negative length fields; the client library blindly allocates and indexes arrays, triggering NegativeArraySizeException, ArrayIndexOutOfBoundsException, or large memory consumption that affects the Java application.

How to fix it

Upgrade MariaDB Connector/J to version 3.3.7, 3.4.5, or 3.5.11 or later; if immediate upgrade is not possible, avoid XA recovery operations or isolate connections from untrusted database endpoints.

How to confirm the fix worked

Confirm the running connector version is at least 3.3.7, 3.4.5, or 3.5.11; test XA recovery against a server returning invalid length fields and verify absence of NegativeArraySizeException or ArrayIndexOutOfBoundsException; review connection pool configuration for XA usage.

Typical attack path

1. Position as malicious database server or intercept client traffic via MITM
2. Respond to XA RECOVER command with manipulated gtrid_length and bqual_length values
3. Trigger XA recovery in the client application via normal transaction or connection pool activity
4. Induce large allocations or array exceptions that crash or destabilize the Java process

How to detect it

Search application and JVM logs for NegativeArraySizeException or ArrayIndexOutOfBoundsException occurring during XA recovery calls; inspect network traffic or database server logs for anomalous XA RECOVER responses with unusual length fields; correlate with connection pool activity around the time of exceptions.

What your security team should do

• Prioritize upgrade of MariaDB Connector/J to a fixed release within the next maintenance window given the two-day publication age
• Scan dependency manifests for versions between 3.0.0 and the fixed releases
• Monitor application logs for XA-related array exceptions as a temporary detection measure
• Restrict database connections to trusted endpoints only until patched