CVE-2026-101768

A flaw was found in MySQL Connector/J. An unauthenticated remote attacker with network access via Hypertext Transfer Protocol HTTP could exploit this vulnerability to compromise the host application process. A successful attack allows the attacker to take over the application process, potentially...

SUSE CVE-2026-119210

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

SUSE CVE-2026-119276

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENTSESSIONTRACK was negotiated, the OkPacket.parse and OkPacket.parseWithInfo paths allocated byte arrays using server-declared lengths for the ...

SUSE CVE-2026-119277

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirmin...

SUSE CVE-2026-119278

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

SUSE CVE-2026-119279

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength and ReadableByteBuf.readIntLengthEncodedNotNull methods narrowed the protocol's unsigned 8-byte length-encoded integer to...

SUSE CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

SUSE CVE-2026-119281

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to charactersetclient. It did not reject non-UTF-8 charactersetresults changes an...

CVE-2026-101678

A flaw was found in MySQL Connector/J. An unauthenticated remote attacker could exploit this vulnerability across the network by enticing a user to interact with malicious requests. A successful attack allows the attacker to cause a partial Denial of Service DoS, leading to temporary service...

CVE-2026-101677

A flaw was found in MySQL Connector/J. An unauthenticated remote attacker could exploit this vulnerability by convincing a user to interact with a malicious service across the network. A successful attack can result in unauthorized modification, insertion, or deletion of accessible data...

CVE-2026-119281

A flaw was found in MariaDB Connector/J. The database connector fails to properly validate changes to the result character set and incorrectly assumes all returned data is UTF-8 encoded. A malicious database server or an attacker intercepting network communication a machine-in-the-middle attacker...

CVE-2026-119277

A flaw was found in MariaDB Connector/J. This vulnerability can lead to a Denial of Service DoS because packet decoders do not verify that sufficient data remains in the receive buffer before reading server-specified lengths. A compromised database server or an attacker positioned between the...

CVE-2026-119276

A flaw was found in MariaDB Connector/J. When processing database response packets, the driver allocates memory based on server-declared lengths before verifying that sufficient data remains in the packet. A malicious database server or an attacker positioned in the middle of network communicatio...

CVE-2026-119279

A flaw was found in MariaDB Connector/J. A malicious or compromised database server, or an attacker intercepting network traffic, can cause a Denial of Service DoS by sending crafted responses containing excessively large length values. Because the connector converts these protocol values into...

CVE-2026-119210

A flaw was found in MariaDB Connector/J. This vulnerability can lead to information disclosure when client-side local file handling is enabled. A compromised database server or a machine-in-the-middle attacker can provide crafted database or table identifiers that bypass filename validation check...

CVE-2026-119278

A flaw was found in MariaDB Connector/J. A malicious server or an attacker intercepting network traffic can exploit this vulnerability by sending a malformed authentication response during the connection handshake. Because the driver does not properly validate the response structure, this issue c...

CVE-2023-21971_Analysis

CVE-2023-21971 Connector/J RCE Analysis References Remote Code Execution RCE in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access MYSQL JDBC Deserialization Analysis - 跳跳糖 tttang.com Vulnerability Overview Vulnerability in...

CVE-2021-2471

CVE-2021-2471 - XXE in MySQL Connector/J Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.26 and prior. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access ...

EUVD-2026-113383

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets...

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

Summary MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the packet. A rogue or MitM server can make the client allocate megabytes from a packet of a few bytes. Details When CLIENTSESSIONTRACK is negotiated the...