MariaDB Connector/J decoders for OK packets, column definitions, text, and binary row data use server‑declared lengths without validating that the requested bytes are present in the receive buffer. This flaw allows a malicious or compromised database server—or a man‑in‑the‑middle attacker—to force the driver to read beyond packet boundaries, triggering unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException errors that terminate connection handling. The consequence is an application‑level denial of service; the attacker gains no code execution or data exfiltration capability.

The vulnerability affects MariaDB Corporation’s MariaDB Connector/J for Java applications. Any 3.x release older than 3.3.7, 3.4.5, or 3.5.11 is impacted, including all releases from 3.0.0 up to but not including those fixed versions.

The CVSS score of 5.9 indicates moderate severity, and the lack of an EPSS score suggests limited public exploitation data. The issue is not listed in CISA’s KEV catalog. Exploitation requires control or compromise of a database server or interception of traffic to a client using the vulnerable driver, making the attack vector network‑based. Successful exploitation results in application crashes and denial of service without granting remote code execution or data theft.