MariaDB Connector/J Flaws Let Rogue Servers Read Client Files

Threat: Vulnerability

Targeted Region: Global

Targeted Sector: Technology & IT

Criticality: Medium

[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in MariaDB Connector/J, the Java database client used to communicate with MariaDB servers. The issues affect client-side handling of server-supplied character set state, local file request validation, distributed transaction recovery data, length-encoded integers, and session state lengths. Affected version ranges include 3.0.0 through 3.3.6, 3.4.0 through 3.4.4, and 3.5.0 through 3.5.10, with some issues affecting a narrower 3.5 range. Overall, a malicious or compromised server can cause data integrity problems, file disclosure, or client-side denial of service.

CVE-2026-119281 (CVSS 5.9 — Medium): The connector did not sufficiently guard the result character set and relied on server-provided session tracking notices. A malicious or compromised server could change the result character set without the client detecting it, causing returned data to be decoded incorrectly and potentially defeating application-side validation or escaping.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-119210 (CVSS 5.9 — Medium): The local file request validation could be satisfied by text embedded in quoted identifiers, string literals, or comments. A malicious or compromised server could cause the client to open and transmit arbitrary files readable by the client application when standard metadata or result-set operations reused server-supplied identifiers.

CVE-2026-119280 (CVSS 3.7 — Low): The distributed transaction recovery routine trusted server-supplied lengths for transaction identifier components. A malicious or compromised server could provide negative, oversized, or inconsistent lengths, causing large allocations or exceptions during recovery and affecting availability.

CVE-2026-119279 (CVSS 5.9 — Medium): The connector narrowed large length-encoded integers from the server to a smaller integer type without validating the result. A malicious or compromised server could send values that truncate to negative or arbitrary lengths, causing exceptions or oversized allocations in client connection handling.

CVE-2026-119276 (CVSS 5.9 — Medium): The connector allocated memory based on server-declared lengths in session state data before checking that the lengths fit within the received packet. A malicious or compromised server could trigger large heap allocations from small packets, creating memory pressure or denial of service in the client application.

These vulnerabilities collectively present a meaningful risk to Java applications that rely on the affected database client to interpret server responses. The most exposed environments are those where the client can reach a malicious, compromised, or intercepted database server, because server-controlled values can alter data interpretation, disclose local files, or exhaust client memory. The general action is to treat server-supplied protocol data as untrusted and limit client exposure to untrusted database endpoints.