CVE-2026-119280 — 脆弱性インテリジェンス
mariadb-corporation — org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client
公表日:
- CVSS
- 3.7
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
## Summary
`XAResource.recover()` in MariaDB Connector/J trusted the `gtrid_length` and
`bqual_length` columns returned by `XA RECOVER` to allocate and split each Xid.
## Details
`MariaDbPoolConnection` and `MariaDbPoolPinnedConnection` built each `Xid` of
the recovery list by allocating `new byte[gtrid_length]` and
`new byte[bqual_length]` and copying from the `data` column, without validating
the lengths against the XA specification bounds (`Xid.MAXGTRIDSIZE`,
`Xid.MAXBQUALSIZE`) or the actual payload. Negative or oversized lengths, or
lengths that do not fit the data, ended in large allocations or unchecked
exceptions (`NegativeArraySizeException`, `ArrayIndexOutOfBoundsException`)
during recovery.
The fix validates the lengths before any allocation or copy and reports an
invalid row as an `XAException` (`XAER_RMFAIL`).
## Impact
Availability only, and limited to applications running XA recovery: a malicious
or compromised server, or a MitM, can crash the recovery or drive large
allocations. Exploitation requires control of the server side of the connection.
## Credit
Reported by fg0x0