{"id":"GHSA-4jq2-8v3c-97w8","summary":"MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths","details":"## Summary\n\n`XAResource.recover()` in MariaDB Connector/J trusted the `gtrid_length` and\n`bqual_length` columns returned by `XA RECOVER` to allocate and split each Xid.\n\n## Details\n\n`MariaDbPoolConnection` and `MariaDbPoolPinnedConnection` built each `Xid` of\nthe recovery list by allocating `new byte[gtrid_length]` and\n`new byte[bqual_length]` and copying from the `data` column, without validating\nthe lengths against the XA specification bounds (`Xid.MAXGTRIDSIZE`,\n`Xid.MAXBQUALSIZE`) or the actual payload. Negative or oversized lengths, or\nlengths that do not fit the data, ended in large allocations or unchecked\nexceptions (`NegativeArraySizeException`, `ArrayIndexOutOfBoundsException`)\nduring recovery.\n\nThe fix validates the lengths before any allocation or copy and reports an\ninvalid row as an `XAException` (`XAER_RMFAIL`).\n\n## Impact\n\nAvailability only, and limited to applications running XA recovery: a malicious\nor compromised server, or a MitM, can crash the recovery or drive large\nallocations. Exploitation requires control of the server side of the connection.\n\n## Credit\n\nReported by fg0x0","aliases":["CVE-2026-119280"],"modified":"2026-10-30T23:15:05.680961929Z","published":"2026-10-30T23:00:01Z","database_specific":{"github_reviewed_at":"2026-10-30T23:00:01Z","nvd_published_at":"2026-10-29T21:17:21Z","cwe_ids":["CWE-20","CWE-789"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119280"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b"},{"type":"PACKAGE","url":"https://github.com/mariadb-corporation/mariadb-connector-j"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"}],"affected":[{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.7"}]}],"versions":["3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json"}},{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}]}],"versions":["3.4.0","3.4.1","3.4.2","3.4.3","3.4.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json"}},{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.11"}]}],"versions":["3.5.0","3.5.1","3.5.10","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}