Skip to content
OpenAdvisories
Medium WID-SEC-2026-4250 7 CVEs

MariaDB Java Connector: Mehrere Schwachstellen

Published Oct 29, 2026 · Updated Oct 29, 2026 · de-DE

Vendor: MariaDB Product: MariaDB Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB Java Connector ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder vertrauliche Daten offenzulegen.

Product

MariaDB ist ein relationales Datenbanksystem, das anwendungskompatibel mit MySQL ist.

Vulnerabilities 7

  • Medium 5.9
    CVE-2026-119210

    MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE …

    MariaDB mariadb-connector-j zipkin keycloak-26.6-iamguarded-compat Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2026-119276

    MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte a…

    MariaDB mariadb-connector-j zipkin keycloak-26.6-iamguarded-compat Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2026-119277

    MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used ser…

    MariaDB mariadb-connector-j mariadb-connector-java mariadb-connector-java Debian Ubuntu
  • Medium 5.9
    CVE-2026-119278

    MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte arr…

    MariaDB mariadb-connector-j mariadb-connector-java mariadb-connector-java Debian Ubuntu
  • Medium 5.9
    CVE-2026-119279

    MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's…

    MariaDB mariadb-connector-j zipkin keycloak-26.6-iamguarded-compat Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2026-119281

    MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject …

    MariaDB mariadb-connector-j zipkin keycloak-26.6-iamguarded-compat Debian Ubuntu Wolfi Maven
  • Low 3.7
    CVE-2026-119280

    MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_le…

    MariaDB mariadb-connector-j zipkin keycloak-26.6-iamguarded-compat Debian Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References