CVE-2026-119280

Summary

XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and
bqual_length columns returned by XA RECOVER to allocate and split each Xid.

Details

MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of
the recovery list by allocating new byte[gtrid_length] and
new byte[bqual_length] and copying from the data column, without validating
the lengths against the XA specification bounds (Xid.MAXGTRIDSIZE,
Xid.MAXBQUALSIZE) or the actual payload. Negative or oversized lengths, or
lengths that do not fit the data, ended in large allocations or unchecked
exceptions (NegativeArraySizeException, ArrayIndexOutOfBoundsException)
during recovery.

The fix validates the lengths before any allocation or copy and reports an
invalid row as an XAException (XAER_RMFAIL).

Impact

Availability only, and limited to applications running XA recovery: a malicious
or compromised server, or a MitM, can crash the recovery or drive large
allocations. Exploitation requires control of the server side of the connection.

Credit

Reported by fg0x0