Bug 2563696 (CVE-2026-119276)

Summary: CVE-2026-119276 org.mariadb.jdbc/mariadb-java-client: mariadb-java-client: Denial of Service via uncontrolled memory allocation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ant, aschwart, aszczucz, boliveir, ccranfor, cescoffi, drichtar, eglynn, ehelms, fmongiar, ggainey, gsmet, janstey, jjoyce, jmartisk, jpasqual, jpechane, jpretori, jschluet, juwatts, lhh, manderse, mburns, mdellweg, mgarciac, mhulan, mposolda, nmoumoul, olubyans, osousa, ozzy, pcreech, pjindal, rchan, rguimara, rhel-process-autobot, rmartinc, sbiarozk, smallamp, ssilvert, sthorger, tmalecek, varjain, vmuzikar, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MariaDB Connector/J. When processing database response packets, the driver allocates memory based on server-declared lengths before verifying that sufficient data remains in the packet. A malicious database server or an attacker positioned in the middle of network communication can send crafted response packets with manipulated length values to trigger uncontrolled memory allocations. This flaw can exhaust available system memory, leading to an OutOfMemoryError and a Denial of Service (DoS) for the client application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 21:23:35 UTC 
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.