CVE-2026-119276: MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

Vulnerability summary

CVE-2026-119276 is a medium (CVSS 5.9) vulnerability in mariadb-corporation mariadb-connector-j. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 28.7% of scored vulnerabilities.

Timeline

1. 29-10-2026
   PublishedVulnerability first disclosed.
2. 30-10-2026
   Last modifiedVulnerability information updated.

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

• CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.