DEBIAN-CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700

MariaDB Connector/J (Java driver for MariaDB/MySQL) has a flaw in ClientMessage.readPacket : it processes a server-initiated LOCAL INFILE protocol packet (0xfb) without enforcing the allowLocalInfile=false setting. When an application sends a LOAD DATA LOCAL INFILE query, a rogue or man-in-the-mi...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

PT-2026-94379

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description MariaDB Connector/J fails to enforce the...

CVE-2026-61700: Improper Access Control

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

MariaDB: Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket

MariaDB Connector/J was found to have an unbounded result-set field-count allocation vulnerability. When parsing result-set responses, the driver read the column count directly from the wire and used it to size a Java array without validation. A malicious server was able to declare an extremely...