CVE-2026-119277

A flaw was found in MariaDB Connector/J. This vulnerability can lead to a Denial of Service (DoS) because packet decoders do not verify that sufficient data remains in the receive buffer before reading server-specified lengths. A compromised database server or an attacker positioned between the client and server can send malformed packets, triggering unexpected exceptions that terminate connection handling.

Red Hat Product Security rates this vulnerability as Moderate severity because successful exploitation requires an adversary to either control the database backend or perform man-in-the-middle traffic interception, and the resulting impact is confined to a client-side denial of service. Typical Red Hat environments deploy database clients within secured network boundaries, limiting an external attacker's ability to inject malformed server responses. Furthermore, triggering the vulnerability only aborts active connections through unhandled client exceptions, posing no risk to host confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.