CVE-2026-119279

Summary

MariaDB Connector/J narrowed 8-byte length-encoded integers received from the
server to int without validation. A rogue or MitM server can send a value above
Integer.MAX_VALUE whose truncation becomes a negative or arbitrary length.

Details

The protocol encodes lengths as length-encoded integers, whose 8-byte form the
decoder (readLength() and readIntLengthEncodedNotNull()) returned as
(int) readLong(). A value above Integer.MAX_VALUE therefore wrapped to a
negative or unrelated int, used afterwards as a length to size allocations or
reads, which ended in NegativeArraySizeException, out-of-bounds exceptions or
oversized allocations.

The fix rejects any length-encoded value that does not fit a non-negative int
with an explicit error.

Impact

Availability only: a malicious or compromised server, or a MitM, can crash the
client's connection handling with unchecked exceptions or drive oversized
allocations. Exploitation requires control of the server side of the connection;
no authentication bypass, confidentiality or integrity impact.

Credit

Reported by fg0x0