The vulnerability arises when MariaDB Connector/J processes the caching_sha2_password authentication response. The driver assumes the authentication‑more‑data packet is a length‑encoded byte array and allocates memory based on the server‑declared length without verifying the packet size. A malicious or compromised server, or an attacker performing a man‑in‑the‑middle attack, can send a packet with an overly large length or an empty response before any password is transmitted. This causes excessive memory allocation or triggers an unchecked ArrayIndexOutOfBoundsException that propagates from DriverManager.getConnection(), resulting in the client application crashing. The flaw leads to a denial of service for the client, and does not provide remote code execution or other higher‑impact capabilities.

This issue affects MariaDB Connector/J from version 3.0.0 through 3.3.6 and 3.4.4. Applications that use those Connector/J versions to connect Java applications to MariaDB or MySQL databases are susceptible. The vulnerability is resolved in Connector/J 3.3.7 and 3.4.5 and later releases.

The CVSS score of 5.9 reflects a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation requires a malicious or compromised database server or the ability to intercept the authentication traffic, such as a man‑in‑the‑middle attack. While it does not grant code execution or data exfiltration, an attacker can reliably force the client to crash, disabling application functionality and potentially triggering cascading failures in dependent services.