CVE-2026-119276

A flaw was found in MariaDB Connector/J. When processing database response packets, the driver allocates memory based on server-declared lengths before verifying that sufficient data remains in the packet. A malicious database server or an attacker positioned in the middle of network communication can send crafted response packets with manipulated length values to trigger uncontrolled memory allocations. This flaw can exhaust available system memory, leading to an OutOfMemoryError and a Denial of Service (DoS) for the client application.

This vulnerability is rated as Moderate severity because exploitation requires either a compromised database server or an attacker positioned to perform machine-in-the-middle manipulation of network traffic. A rogue endpoint can trigger excessive memory allocations during response parsing, leading to client-side resource exhaustion or application termination via OutOfMemory errors. Because client connections in supported Red Hat deployments typically communicate with authenticated internal database instances, the exposure is limited, and the flaw cannot be leveraged for data confidentiality or integrity breaches.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.