MariaDB Connector/J used in Java applications performs XA recovery by trusting the gtrid_length and bqual_length fields supplied by the database during the XA RECOVER command. Because the driver does not validate these lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual payload, a malicious or compromised server or a man‑in‑the‑middle attacker can trigger large memory allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during recovery, causing the application to fail or crash. This flaw does not provide code execution or privilege escalation, but it can disrupt database transactions and lead to service interruption.

The vulnerability affects MariaDB Connector/J from version 3.0.0 through 3.3.7, 3.4.5, and 3.5.11. These releases are distributed by MariaDB Corporation. Any Java application using these driver versions and performing XA recovery is impacted.

The CVSS score for this issue is 3.7, indicating low severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to control or tamper with the database server or to intercept and alter the network traffic between the application and the database. Thus, while exploitation is possible, it is limited to environments where the attacker can influence the server responses or perform a man‑in‑the‑middle attack. The risk is moderate, making patching the recommended course of action.