CVE-2026-119278
Description
A flaw was found in MariaDB Connector/J. A malicious server or an attacker intercepting network traffic can exploit this vulnerability by sending a malformed authentication response during the connection handshake. Because the driver does not properly validate the response structure, this issue can trigger excessive memory allocation or an unhandled crash, resulting in a Denial of Service (DoS).
Statement
Red Hat has evaluated this vulnerability as having a Moderate impact because successful exploitation requires high attack complexity, necessitating either a rogue database server or a machine-in-the-middle network interception of the connection handshake. In typical Red Hat deployments, enterprise Java applications communicate with trusted backend databases across secured, isolated network segments, limiting opportunities for traffic tampering. Furthermore, the issue only affects connections using the caching_sha2_password authentication plugin and causes client-side connection failure or resource exhaustion without compromising system confidentiality or data integrity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Memory; Modify Memory; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
