MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From
    3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and
    OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info
    field and session-state variable names and values before confirming that the bytes remained in the packet.
    A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet
    declaring a much larger length and repeatedly force attacker-controlled heap allocations before the
    subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client
    application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11. (CVE-2026-119276)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From     3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and     OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info     field and session-state variable names and values before confirming that the bytes remained in the packet.
    A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet     declaring a much larger length and repeatedly force attacker-controlled heap allocations before the     subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client     application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11. (CVE-2026-119276)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478130	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.1-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478130	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.1-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
478068	SCA: security update for org.mariadb.jdbc:mariadb-java-client (GHSA-h599-m3w5-9m7x)	Tenable Cloud Security	SCA Checks	Local	medium
478068	SCA: security update for org.mariadb.jdbc:mariadb-java-client (GHSA-h599-m3w5-9m7x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
374229	Linux Distros Unpatched Vulnerability : CVE-2026-119276	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-119276

medium

Tenable Plugins

medium

medium

medium

medium

medium