Bug 2563700 (CVE-2026-119279)

Summary: CVE-2026-119279 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via integer truncation in length handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ant, aschwart, aszczucz, boliveir, ccranfor, cescoffi, drichtar, eglynn, ehelms, fmongiar, ggainey, gsmet, janstey, jjoyce, jmartisk, jpasqual, jpechane, jpretori, jschluet, juwatts, lhh, manderse, mburns, mdellweg, mgarciac, mhulan, mposolda, nmoumoul, olubyans, osousa, ozzy, pcreech, pjindal, rchan, rguimara, rhel-process-autobot, rmartinc, sbiarozk, smallamp, ssilvert, sthorger, tmalecek, varjain, vmuzikar, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MariaDB Connector/J. A malicious or compromised database server, or an attacker intercepting network traffic, can cause a Denial of Service (DoS) by sending crafted responses containing excessively large length values. Because the connector converts these protocol values into signed integers without bounds checking, the values can wrap to negative numbers or trigger oversized memory allocations. This issue causes unhandled exceptions or crashes in client applications during connection handling.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 21:34:15 UTC 
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10.