GHSA-797x-p4mc-jwpm

Suggest an improvement
Source
https://github.com/advisories/GHSA-797x-p4mc-jwpm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-797x-p4mc-jwpm/GHSA-797x-p4mc-jwpm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-797x-p4mc-jwpm
Aliases
Published
2026-10-30T23:00:07Z
Modified
2026-10-30T23:15:05Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
Details

Summary

MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to int without validation. A rogue or MitM server can send a value above Integer.MAX_VALUE whose truncation becomes a negative or arbitrary length.

Details

The protocol encodes lengths as length-encoded integers, whose 8-byte form the decoder (readLength() and readIntLengthEncodedNotNull()) returned as (int) readLong(). A value above Integer.MAX_VALUE therefore wrapped to a negative or unrelated int, used afterwards as a length to size allocations or reads, which ended in NegativeArraySizeException, out-of-bounds exceptions or oversized allocations.

The fix rejects any length-encoded value that does not fit a non-negative int with an explicit error.

Impact

Availability only: a malicious or compromised server, or a MitM, can crash the client's connection handling with unchecked exceptions or drive oversized allocations. Exploitation requires control of the server side of the connection; no authentication bypass, confidentiality or integrity impact.

Credit

Reported by fg0x0

Database specific 
{
    "cwe_ids":  [
        "CWE-130",
        "CWE-190"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-30T23:00:07Z",
    "nvd_published_at":  "2026-10-29T21:17:21Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
View open source insights on deps.dev
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.3.7

Affected versions

3.*
3.0.1-beta
3.0.2-rc
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-797x-p4mc-jwpm/GHSA-797x-p4mc-jwpm.json"
org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
View open source insights on deps.dev
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.4.0
Fixed
3.4.5

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-797x-p4mc-jwpm/GHSA-797x-p4mc-jwpm.json"
org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
View open source insights on deps.dev
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.5.0
Fixed
3.5.10

Affected versions

3.*
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-797x-p4mc-jwpm/GHSA-797x-p4mc-jwpm.json"