CVE-2026-119279

A flaw was found in MariaDB Connector/J. A malicious or compromised database server, or an attacker intercepting network traffic, can cause a Denial of Service (DoS) by sending crafted responses containing excessively large length values. Because the connector converts these protocol values into signed integers without bounds checking, the values can wrap to negative numbers or trigger oversized memory allocations. This issue causes unhandled exceptions or crashes in client applications during connection handling.

This vulnerability is rated as Moderate because successful exploitation requires an adversary to either compromise the upstream database server or gain a privileged network position to manipulate traffic as a machine-in-the-middle. In typical Red Hat environments, Java enterprise services communicate with database backends across protected internal networks or encrypted channels, reducing exposure to traffic interception. Furthermore, the impact is confined to client-side denial of service through connection crashes or excess memory allocation, presenting no threat to data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.