CVE-2026-119281

The MariaDB Connector/J (versions 3.0.0 through 3.3.7, 3.4.5, and 3.5.11) is vulnerable to an encoding issue where the connector incorrectly assumed result bytes were UTF-8 while failing to reject non-UTF-8 character_set_results changes. Because it relied on the server's global session_track_syst...

CVE-2026-119280

The MariaDB Connector/J driver (versions 3.0.0 through 3.3.7, 3.4.5, and 3.5.11) is vulnerable to improper input validation during XA RECOVER operations. Specifically, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() methods trust the gtrid_length and bqual_length col...

CVE-2026-119279

The MariaDB Connector/J library, used for connecting Java applications to MariaDB and MySQL databases, is vulnerable to an integer truncation issue. In versions prior to 3.3.7, 3.4.5, and 3.5.10 , the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods improperl...

CVE-2026-119278 MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-119278

Versions 3.0.0 through 3.3.7 and 3.4.5 of MariaDB Connector/J are vulnerable to a denial-of-service condition during caching_sha2_password authentication. The root cause is the improper handling of the authentication-more-data response, where the driver treats it as a length-encoded byte array an...

CVE-2026-119277 MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirmin...

CVE-2026-119277

The MariaDB Connector/J (versions 3.0.0 through 3.3.7, 3.4.5, and 3.5.11) is vulnerable to an out-of-bounds read condition. The issue resides in the decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data , which utilize server-declared lengths wi...

CVE-2026-119276 MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENTSESSIONTRACK was negotiated, the OkPacket.parse and OkPacket.parseWithInfo paths allocated byte arrays using server-declared lengths for the ...

CVE-2026-119276

MariaDB Connector/J (versions 3.0.0 until 3.3.7, 3.4.5, and 3.5.11) is vulnerable to memory exhaustion when CLIENT_SESSION_TRACK is negotiated. The OkPacket.parse() and OkPacket.parseWithInfo() methods incorrectly allocate byte arrays based on server-declared lengths for the OK packet info field ...

CVE-2026-119210

The MariaDB Connector/J (versions 3.0.0 until 3.3.7, 3.4.5, and 3.5.11) is vulnerable to an information disclosure issue where the ClientMessage.validateLocalFileName() check uses an improper regular expression. This allows it to match LOAD DATA LOCAL INFILE text within quoted identifiers, string...

CVE-2026-119210 MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

CVE-2026-119280: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119278: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-119279: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength and ReadableByteBuf.readIntLengthEncodedNotNull methods narrowed the protocol's unsigned 8-byte length-encoded integer to...

CVE-2026-119277: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirmin...

CVE-2026-119210: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

CVE-2026-119281: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to charactersetclient. It did not reject non-UTF-8 charactersetresults changes an...

CVE-2026-119276: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENTSESSIONTRACK was negotiated, the OkPacket.parse and OkPacket.parseWithInfo paths allocated byte arrays using server-declared lengths for the ...

CLEANSTART-2026-DR90917 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

Security vulnerability affects the rundeck package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...

PT-2026-132932

Security vulnerability affects the keycloak package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...