CVE-2026-119279 — Vulnerability intelligence
mariadb-corporation — org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client
Published:
- CVSS
- 5.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
## Summary
MariaDB Connector/J narrowed 8-byte length-encoded integers received from the
server to `int` without validation. A rogue or MitM server can send a value above
`Integer.MAX_VALUE` whose truncation becomes a negative or arbitrary length.
## Details
The protocol encodes lengths as length-encoded integers, whose 8-byte form the
decoder (`readLength()` and `readIntLengthEncodedNotNull()`) returned as
`(int) readLong()`. A value above `Integer.MAX_VALUE` therefore wrapped to a
negative or unrelated `int`, used afterwards as a length to size allocations or
reads, which ended in `NegativeArraySizeException`, out-of-bounds exceptions or
oversized allocations.
The fix rejects any length-encoded value that does not fit a non-negative `int`
with an explicit error.
## Impact
Availability only: a malicious or compromised server, or a MitM, can crash the
client's connection handling with unchecked exceptions or drive oversized
allocations. Exploitation requires control of the server side of the connection;
no authentication bypass, confidentiality or integrity impact.
## Credit
Reported by fg0x0