CVE-2026-119278

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5.

• CWE-129
• CWE-789

• https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
• https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11927IBM Security Verify Identity Access reverse proxy may allow …6.5
• CVE-2026-119270Improper input validation in CacheStorage in Google Chrome p…8.8
• CVE-2026-119271Use after free in Skia in Google Chrome prior to 156.0.8078.…8.8
• CVE-2026-119272Out of bounds read in FileSystem in Google Chrome prior to 1…4.3
• CVE-2026-119276MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119277MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119279MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-11928IBM Verify Identity Access is vulnerable to a buffer overflo…9.8
• CVE-2026-119280MariaDB Connector/J is used to connect applications develope…3.7
• CVE-2026-119281MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119282Nx is a monorepo solution for TypeScript and polyglot codeba…7.3
• CVE-2026-119283joserfc is a Python library that provides an implementation …7.5