The vulnerability allows a server that speaks the CLIENT_SESSION_TRACK protocol to instruct the Java client to allocate memory using lengths declared in OK packets before bounds checking. By sending a packet with an oversized length, an attacker can force repeated large heap allocations, causing excessive garbage‑collection pressure or an OutOfMemoryError that halts or crashes the client application, effectively denying service. The weakness is a classic unchecked allocation and resource exhaustion, denoted by CWE-130 and CWE-789.

MariaDB Connector/J versions 3.0.0 up to and including 3.3.6, 3.4.4, and 3.5.10 are vulnerable. The issue is fixed in releases 3.3.7, 3.4.5, and 3.5.11 and later. The product is the Java connector shipped by MariaDB Corporation.

The CVSS score of 5.9 indicates moderate severity. No EPSS value is available and the vulnerability is not listed in CISA's KEV catalog. An attacker must be able to send forged OK packets, which requires control of the database server or a man‑in‑the‑middle position on the network path. While an active exploit has not been reported, vulnerable clients could be turned into denial‑of‑service targets if exposed to untrusted servers. The risk is therefore moderate but can be high in environments that connect to unverified database endpoints.