GHSA-4jq2-8v3c-97w8

Suggest an improvement
Source
https://github.com/advisories/GHSA-4jq2-8v3c-97w8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4jq2-8v3c-97w8
Aliases
Published
2026-10-30T23:00:01Z
Modified
2026-10-30T23:15:05Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
Details

Summary

XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and bqual_length columns returned by XA RECOVER to allocate and split each Xid.

Details

MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of the recovery list by allocating new byte[gtrid_length] and new byte[bqual_length] and copying from the data column, without validating the lengths against the XA specification bounds (Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE) or the actual payload. Negative or oversized lengths, or lengths that do not fit the data, ended in large allocations or unchecked exceptions (NegativeArraySizeException, ArrayIndexOutOfBoundsException) during recovery.

The fix validates the lengths before any allocation or copy and reports an invalid row as an XAException (XAER_RMFAIL).

Impact

Availability only, and limited to applications running XA recovery: a malicious or compromised server, or a MitM, can crash the recovery or drive large allocations. Exploitation requires control of the server side of the connection.

Credit

Reported by fg0x0

Database specific 
{
    "cwe_ids":  [
        "CWE-20",
        "CWE-789"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-30T23:00:01Z",
    "nvd_published_at":  "2026-10-29T21:17:21Z",
    "severity":  "LOW"
}
References

Affected packages

Maven
org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
View open source insights on deps.dev
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.3.7

Affected versions

3.*
3.0.1-beta
3.0.2-rc
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json"
org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
View open source insights on deps.dev
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.4.0
Fixed
3.4.5

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json"
org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
View open source insights on deps.dev
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.5.0
Fixed
3.5.11

Affected versions

3.*
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4jq2-8v3c-97w8/GHSA-4jq2-8v3c-97w8.json"