{"id":"GHSA-h599-m3w5-9m7x","summary":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","details":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session state at the first inconsistent\nentry.\n\n## Impact\n\nAvailability only: a malicious or compromised server, or a MitM, can drive\nattacker-controlled heap allocations on every OK packet, creating GC pressure up to\n`OutOfMemoryError` in the client application. Exploitation requires control of the\nserver side of the connection; no authentication bypass, confidentiality or\nintegrity impact.\n\n## Credit\n\nReported by fg0x0","aliases":["CVE-2026-119276"],"modified":"2026-10-30T23:15:06.518147727Z","published":"2026-10-30T23:00:12Z","database_specific":{"cwe_ids":["CWE-130","CWE-789"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-30T23:00:12Z","nvd_published_at":"2026-10-29T21:17:20Z"},"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119276"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56"},{"type":"PACKAGE","url":"https://github.com/mariadb-corporation/mariadb-connector-j"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"}],"affected":[{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.7"}]}],"versions":["3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h599-m3w5-9m7x/GHSA-h599-m3w5-9m7x.json"}},{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}]}],"versions":["3.4.0","3.4.1","3.4.2","3.4.3","3.4.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h599-m3w5-9m7x/GHSA-h599-m3w5-9m7x.json"}},{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.11"}]}],"versions":["3.5.0","3.5.1","3.5.10","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h599-m3w5-9m7x/GHSA-h599-m3w5-9m7x.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}