Hi,

The following vulnerabilities were published for mariadb-connector-java.

CVE-2026-119210[0]:
| MariaDB Connector/J is used to connect applications developed in
| Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5,
| and 3.5.11, the ClientMessage.validateLocalFileName() check used a
| regular expression that could match LOAD DATA LOCAL INFILE text
| inside quoted identifiers, string literals, or comments instead of
| requiring a real statement. A malicious or compromised server, or a
| machine-in-the-middle attacker, could return crafted database or
| table identifiers that the connector reused in metadata or
| updatable-result queries, then answer with a LOCAL INFILE request
| for a client file. With allowLocalInfile enabled, this caused the
| connector to stream any readable client-host file named by the
| crafted text, including through DatabaseMetaData.getImportedKeys(),
| DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths.
| This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.


CVE-2026-119276[1]:
| MariaDB Connector/J is used to connect applications developed in
| Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5,
| and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the
| OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte
| arrays using server-declared lengths for the OK packet info field
| and session-state variable names and values before confirming that
| the bytes remained in the packet. A malicious or compromised server,
| or a machine-in-the-middle attacker, could send a small OK packet
| declaring a much larger length and repeatedly force attacker-
| controlled heap allocations before the subsequent copy failed. This
| could create garbage-collection pressure or an OutOfMemoryError in
| the client application. This issue is fixed in versions 3.3.7,
| 3.4.5, and 3.5.11.


CVE-2026-119277[2]:
| MariaDB Connector/J is used to connect applications developed in
| Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5,
| and 3.5.11, decoders for OK packet session-state blocks, column
| definition packets, text row data, or binary row data used server-
| declared lengths without confirming that the requested bytes
| remained in the receive buffer. The decoders could position reads,
| create sub-buffers, or decode strings beyond the packet boundary. A
| malicious or compromised server, or a machine-in-the-middle
| attacker, could trigger unchecked ArrayIndexOutOfBoundsException or
| IllegalArgumentException failures inside JDBC calls and terminate
| connection handling. This issue is fixed in versions 3.3.7, 3.4.5,
| and 3.5.11.


CVE-2026-119280[3]:
| MariaDB Connector/J is used to connect applications developed in
| Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5,
| and 3.5.11, the MariaDbPoolConnection.recover() and
| MariaDbPoolPinnedConnection.recover() implementations trusted the
| gtrid_length and bqual_length columns returned by XA RECOVER. The
| methods allocated and split Xid byte arrays without validating the
| lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual
| data payload. A malicious or compromised server, or a machine-in-
| the-middle attacker, could cause large allocations,
| NegativeArraySizeException, or ArrayIndexOutOfBoundsException during
| XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and
| 3.5.11.


CVE-2026-119281[4]:
| MariaDB Connector/J is used to connect applications developed in
| Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5,
| and 3.5.11, the connector assumed result bytes were UTF-8 but
| guarded only changes to character_set_client. It did not reject non-
| UTF-8 character_set_results changes and relied on the server's
| global session_track_system_variables configuration to report
| character-set changes. A malicious or compromised server, or a
| machine-in-the-middle attacker, could suppress tracking or change
| the result charset so application strings differed from the returned
| bytes, potentially defeating application-side validation or escaping
| that depended on the decoded values. This issue is fixed in versions
| 3.3.7, 3.4.5, and 3.5.11.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-119210
https://www.cve.org/CVERecord?id=CVE-2026-119210
[1] https://security-tracker.debian.org/tracker/CVE-2026-119276
https://www.cve.org/CVERecord?id=CVE-2026-119276
[2] https://security-tracker.debian.org/tracker/CVE-2026-119277
https://www.cve.org/CVERecord?id=CVE-2026-119277
[3] https://security-tracker.debian.org/tracker/CVE-2026-119280
https://www.cve.org/CVERecord?id=CVE-2026-119280
[4] https://security-tracker.debian.org/tracker/CVE-2026-119281
https://www.cve.org/CVERecord?id=CVE-2026-119281

Regards,
Salvatore