Low severity · published Oct 29, 2026
CVE-2026-119280
MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths
New
3.7
CVSS
–
EPSS
No
On KEV
Description
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mariadb-connector-j · mariadb-corporation
>= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119280
x_refsource_CONFIRM
https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8
x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8
x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47
x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b
x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
More from mariadb-connector-j
5.9
CVE-2026-119281
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
5.9
CVE-2026-119279
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
5.9
CVE-2026-119278
MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication
5.9
CVE-2026-119277
MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths
5.9
CVE-2026-119276
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets