Bug 2563690 (CVE-2026-119277)

Summary: CVE-2026-119277 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated packet lengths
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ant, aschwart, aszczucz, boliveir, ccranfor, cescoffi, drichtar, eglynn, ehelms, fmongiar, ggainey, gsmet, janstey, jjoyce, jmartisk, jpasqual, jpechane, jpretori, jschluet, juwatts, lblicha, lhh, manderse, mburns, mdellweg, mgarciac, mhulan, mposolda, nmoumoul, ogajduse, olubyans, osousa, ozzy, pcreech, pjindal, rchan, rguimara, rhel-process-autobot, rmartinc, sbiarozk, smallamp, ssilvert, sthorger, tmalecek, varjain, vmuzikar, watson-tool-maintainers, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MariaDB Connector/J. This vulnerability can lead to a Denial of Service (DoS) because packet decoders do not verify that sufficient data remains in the receive buffer before reading server-specified lengths. A compromised database server or an attacker positioned between the client and server can send malformed packets, triggering unexpected exceptions that terminate connection handling.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 21:16:39 UTC 
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.