{"items":[{"id":"NVI-00008930","kind":"vulnerability","title":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h599-m3w5-9m7x","CVE-2026-119276"],"plain_summary":"GitHub lists this reviewed advisory for org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0e4cc34e4bdabb27f0f60f123675c849"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:14.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-38f91f13f980559f4c9653cb74514028"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.351%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.28799. Missing scores are unknown.","source_id":"sr-0e4cc34e4bdabb27f0f60f123675c849"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-38f91f13f980559f4c9653cb74514028","url":"https://github.com/advisories/GHSA-h599-m3w5-9m7x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h599-m3w5-9m7x","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-0e4cc34e4bdabb27f0f60f123675c849","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119276","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.779Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.0.0, < 3.3.7"]},{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.4.0, < 3.4.5"]},{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.5.0, < 3.5.11"]}],"null_published_at":"2026-11-06T00:29:57.257Z","source_updated_at":"2026-10-30T23:00:14.000Z","source_disclosed_at":"2026-10-30T23:00:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00008930","kind":"vulnerability","title":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h599-m3w5-9m7x","CVE-2026-119276"],"plain_summary":"GitHub lists this reviewed advisory for org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-04fa0b5fdd85e7f67e274beaf6ee786b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:14.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-38f91f13f980559f4c9653cb74514028"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.351%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.28752. Missing scores are unknown.","source_id":"sr-04fa0b5fdd85e7f67e274beaf6ee786b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-38f91f13f980559f4c9653cb74514028","url":"https://github.com/advisories/GHSA-h599-m3w5-9m7x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h599-m3w5-9m7x","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-04fa0b5fdd85e7f67e274beaf6ee786b","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119276","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.846Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.0.0, < 3.3.7"]},{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.4.0, < 3.4.5"]},{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.5.0, < 3.5.11"]}],"null_published_at":"2026-11-03T17:49:15.003Z","source_updated_at":"2026-10-30T23:00:14.000Z","source_disclosed_at":"2026-10-30T23:00:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00008930","kind":"vulnerability","title":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h599-m3w5-9m7x","CVE-2026-119276"],"plain_summary":"GitHub lists this reviewed advisory for org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-11a4ca8a64c0f619e6cbb7a6930c7c8a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:14.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-38f91f13f980559f4c9653cb74514028"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.351%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.28767. Missing scores are unknown.","source_id":"sr-11a4ca8a64c0f619e6cbb7a6930c7c8a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-38f91f13f980559f4c9653cb74514028","url":"https://github.com/advisories/GHSA-h599-m3w5-9m7x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h599-m3w5-9m7x","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-11a4ca8a64c0f619e6cbb7a6930c7c8a","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119276","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.375Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.0.0, < 3.3.7"]},{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.4.0, < 3.4.5"]},{"certainty":"source_listed","source_ids":["sr-38f91f13f980559f4c9653cb74514028"],"technology":"org.mariadb.jdbc:mariadb-java-client","known_exclusions":[],"conditions_summary":"## Summary\n\nMariaDB Connector/J sized heap allocations from lengths declared by the server\nin OK packets before checking that those lengths fit in the packet. A rogue or\nMitM server can make the client allocate megabytes from a packet of a few bytes.\n\n## Details\n\nWhen `CLIENT_SESSION_TRACK` is negotiated (the default), an OK packet carries an\ninfo field followed by session-state blocks, each tracked variable being sent as a\nlength-encoded name and value. `OkPacket.parse()` and `parseWithInfo()` allocated\n`new byte[len]` for the info field, the variable name and the value with the\nserver-declared `len`, then copied the packet data into it. The copy failed with an\n`ArrayIndexOutOfBoundsException` when the packet was shorter, but only after the\nallocation had taken place.\n\nA server-declared length of 8 MiB in an 18-byte packet was enough to trigger an\n8 MiB allocation; the integer-range validation of length-encoded values does not\nhelp, since such lengths are valid positive integers.\n\nThe fix validates every server-declared length against the remaining packet bytes\nbefore any allocation (`ReadableByteBuf.checkLength()` and a bounded\n`readBytes(int)`), and stops reading the session sta","public_affected_ranges":[">= 3.5.0, < 3.5.11"]}],"null_published_at":"2026-10-31T22:13:48.408Z","source_updated_at":"2026-10-30T23:00:14.000Z","source_disclosed_at":"2026-10-30T23:00:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:55:49.621Z"}],"next_cursor":null,"snapshot_revision":"42594"}