Zero Radar
← feed
LowVulnerabilityCVE-2026-119280updated 30 Oct 2026, 23:00 UTC

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

Fix available · out Official source
SeverityLowCVSS 3.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesorg.mariadb.jdbc:mariadb-java-client 3.3.7, org.mariadb.jdbc:mariadb-java-client 3.4.5, org.mariadb.jdbc:mariadb-java-client 3.5.11 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
org.mariadb.jdbc:mariadb-java-client · maven>= 3.0.0, < 3.3.73.3.7
org.mariadb.jdbc:mariadb-java-client · maven>= 3.4.0, < 3.4.53.4.5
org.mariadb.jdbc:mariadb-java-client · maven>= 3.5.0, < 3.5.113.5.11

Timeline

  1. 30 Oct 2026, 23:00 UTC
    Publicly disclosed
  2. 30 Oct 2026, 23:00 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 30 Oct 2026, 23:00 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119280 · GHSA-4jq2-8v3c-97w8
CVSS
3.7 / 10
Disclosed
30 Oct 2026, 23:00 UTC
On Zero Radar
30 Oct 2026, 23:00 UTC (0 min after disclosure)
Last change
30 Oct 2026, 23:00 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths · Zero Radar