GHSA-797x-p4mc-jwpm

Dashboard / Vulnerabilities / GHSA-797x-p4mc-jwpm

GHSA-797x-p4mc-jwpm

Summary: MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

Details: ## Summary MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to `int` without validation. A rogue or MitM server can send a value above `Integer.MAX_VALUE` whose truncation becomes a negative or arbitrary length. ## Details The protocol encodes lengths as length-encoded integers, whose 8-byte form the decoder (`readLength()` and `readIntLengthEncodedNotNull()`) returned as `(int) readLong()`. A value above `Integer.MAX_VALUE` therefore wrapped to a negative or unrelated `int`, used afterwards as a length to size allocations or reads, which ended in `NegativeArraySizeException`, out-of-bounds exceptions or oversized allocations. The fix rejects any length-encoded value that does not fit a non-negative `int` with an explicit error. ## Impact Availability only: a malicious or compromised server, or a MitM, can crash the client's connection handling with unchecked exceptions or drive oversized allocations. Exploitation requires control of the server side of the connection; no authentication bypass, confidentiality or integrity impact. ## Credit Reported by fg0x0

References: https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm, https://nvd.nist.gov/vuln/detail/CVE-2026-119279, https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99, https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667, https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea, https://github.com/mariadb-corporation/mariadb-connector-j, https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7, https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5, https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10