🎯 New Report #3872239: Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 727
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-09-30 08:00:19
📝 Summary: MariaDB Connector/J was found to have an unbounded result-set field-count allocation vulnerability. When parsing result-set responses, the driver read the column count directly from the wire and used it to size a Java array without validation. A malicious server was able to declare an extremely large field count in a small packet, causing the client JVM to attempt a multi-gigabyte memory allocation and crash with OutOfMemoryError. The crash affected the entire JVM process, taking down all pooled connections and application threads. The vulnerability could be triggered at connection time during driver initialization, before any legitimate query execution and without requiring valid credentials. The driver's default plaintext mode made it susceptible to network-level attacks.
📂 Report JSON File: 3872239
@hackeronereports