CVE-2026-119280: MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and
bqual_length columns returned by XA RECOVER to allocate and split each Xid.
References
- github.com/advisories/GHSA-4jq2-8v3c-97w8
- github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8
- github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47
- github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b
- github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
- github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
- github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11
- github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8
- nvd.nist.gov/vuln/detail/CVE-2026-119280
Code Behaviors & Features
Detect and mitigate CVE-2026-119280 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →