GHSA-4JQ2-8V3C-97W8 MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

Summary XAResource.recover in MariaDB Connector/J trusted the gtridlength and bquallength columns returned by XA RECOVER to allocate and split each Xid. Details MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of the recovery list by allocating new bytegtridlength and new...

EUVD-2026-113387

MariaDB Connector/J: XA recover trusted server-supplied gtrid and bqual lengths...

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

Summary XAResource.recover in MariaDB Connector/J trusted the gtridlength and bquallength columns returned by XA RECOVER to allocate and split each Xid. Details MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of the recovery list by allocating new bytegtridlength and new...

CVE-2026-119280

A flaw was found in MariaDB Connector/J. A malicious database server or an attacker intercepting network traffic can trigger a Denial of Service DoS by returning crafted transaction identifier lengths during distributed transaction XA recovery. Because the connector does not validate these length...

Linux Distros Unpatched Vulnerability : CVE-2026-119280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the...

CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

DEBIAN-CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119280 MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119280 MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119280 MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119280

The MariaDB Connector/J driver (versions 3.0.0 through 3.3.7, 3.4.5, and 3.5.11) is vulnerable to improper input validation during XA RECOVER operations. Specifically, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() methods trust the gtrid_length and bqual_length col...

PT-2026-132837

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions 3.0.0 through 3.3.6 MariaDB Connector/J versions 3.4.0 through 3.4.4 MariaDB Connector/J versions 3.5.0 through 3.5.10 Description The MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover...

CVE-2026-119280: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

PT-2026-121944

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch ktls: disable softirqs around tid list erases chcr ktls cpl act open rpl inserts into tid list from the receive path using xa insert bh. The array is shared by the adapter's connections and initialized with XA FLAGS LOCK...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: removing an entry instead of using null-ptr-dereference in ocfs2xaremove Syzkaller can trigger null-ptr-dereference in ocfs2xaremove: 57.319872 a.out,1161,7:ocfs2xaremove:2028 ERROR: status = -12 57.320420...

PT-2026-98643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the ice driver due to a missing call to the xa destroy function for the sched node ids xarray. The xarray was added to the port info structure but was not properl...

Malicious Package

Overview @nimbusedge2/xa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @nimbusedge2/xa (npm)

Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP port 8080 and pipes the shell's output through curl to...