CVE-2026-119280

A flaw was found in MariaDB Connector/J. A malicious database server or an attacker intercepting network traffic can trigger a Denial of Service (DoS) by returning crafted transaction identifier lengths during distributed transaction (XA) recovery. Because the connector does not validate these length values against allowed limits or the incoming data payload, processing the response can cause excessive memory allocations or unhandled exceptions that crash the client application.

This vulnerability is rated as Low severity because successful exploitation requires an attacker to either control the upstream database server or perform an active machine-in-the-middle attack on the connection. The flaw is confined to distributed XA transaction recovery procedures when parsing responses from the database. As a result, the vulnerability cannot lead to compromise of sensitive data or unauthorized system access, restricting the impact entirely to client-side denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.