MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.9 · mariadb-corporationNVD modified 2026-10-29 20:49
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r x_refsource_confirm
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11 x_refsource_misc