CVE-2026-119278

A flaw was found in MariaDB Connector/J. A malicious server or an attacker intercepting network traffic can exploit this vulnerability by sending a malformed authentication response during the connection handshake. Because the driver does not properly validate the response structure, this issue can trigger excessive memory allocation or an unhandled crash, resulting in a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having a Moderate impact because successful exploitation requires high attack complexity, necessitating either a rogue database server or a machine-in-the-middle network interception of the connection handshake. In typical Red Hat deployments, enterprise Java applications communicate with trusted backend databases across secured, isolated network segments, limiting opportunities for traffic tampering. Furthermore, the issue only affects connections using the caching_sha2_password authentication plugin and causes client-side connection failure or resource exhaustion without compromising system confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.