MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 3.7 · mariadb-corporationNVD modified 2026-10-29 20:55
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8 x_refsource_confirm
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11 x_refsource_misc