{"grype_matches":[{"artifact":{"id":"72ac1fd65402557d","cpes":["cpe:2.3:a:com.google.guava:guava:33.6.0-jre:*:*:*:*:*:*:*","cpe:2.3:a:google:guava:33.6.0-jre:*:*:*:*:*:*:*","cpe:2.3:a:guava:guava:33.6.0-jre:*:*:*:*:*:*:*"],"name":"guava","purl":"pkg:maven/com.google.guava/guava@33.6.0-jre","type":"java-archive","version":"33.6.0-jre","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.google.guava","virtualPath":"/opt/keycloak/lib/lib/main/com.google.guava.guava-33.6.0-jre.jar","manifestName":"","pomArtifactID":"guava","archiveDigests":[{"value":"c376b13067cc99a5774403530953f7b05a91e218","algorithm":"sha1"}]},"locations":[{"path":"/opt/keycloak/lib/lib/main/com.google.guava.guava-33.6.0-jre.jar","layerID":"sha256:50ef5e5672edc7da8210365c8b7b67eff136135637f7ff4e5d55d008a12935f9","accessPath":"/opt/keycloak/lib/lib/main/com.google.guava.guava-33.6.0-jre.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"33.7.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xxph-c9ww-hj94","versionConstraint":">=4.0,<=33.7.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.google.guava:guava","version":"33.6.0-jre"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xxph-c9ww-hj94","fix":{"state":"fixed","versions":["33.7.2"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"33.7.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102554","cwe":"CWE-502","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-102554","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-102554","date":"2026-11-09","epss":0.00352,"percentile":0.29079}],"risk":0.25608000000000003,"urls":["https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94","https://nvd.nist.gov/vuln/detail/CVE-2026-102554","https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","https://github.com/google/guava/releases/tag/v33.7.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xxph-c9ww-hj94","description":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation"},"relatedVulnerabilities":[{"id":"CVE-2026-102554","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102554","cwe":"CWE-502","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-102554","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-102554","date":"2026-11-09","epss":0.00352,"percentile":0.29079}],"urls":["https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","https://github.com/google/guava/releases/tag/v33.7.2","https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams."}]},{"artifact":{"id":"6391e5d014e0e341","cpes":["cpe:2.3:a:mariadb-java-client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java-client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*"],"name":"mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.5.10","type":"java-archive","version":"3.5.10","language":"java","licenses":["\"LGPL-2.1-or-later\""],"metadata":{"pomGroupID":"org.mariadb.jdbc","virtualPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","manifestName":"","pomArtifactID":"mariadb-java-client","archiveDigests":[{"value":"c6a687f7ccb65394103cd516e0583e61e6d92c24","algorithm":"sha1"}]},"locations":[{"path":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","layerID":"sha256:50ef5e5672edc7da8210365c8b7b67eff136135637f7ff4e5d55d008a12935f9","accessPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h599-m3w5-9m7x","versionConstraint":">=3.5.0,<3.5.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","version":"3.5.10"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h599-m3w5-9m7x","fix":{"state":"fixed","versions":["3.5.11"],"available":[{"date":"2026-10-31","kind":"first-observed","version":"3.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119276","cwe":"CWE-130","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-119276","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119276","date":"2026-11-09","epss":0.00351,"percentile":0.28973}],"risk":0.19129500000000002,"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x","https://nvd.nist.gov/vuln/detail/CVE-2026-119276","https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f","https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6","https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h599-m3w5-9m7x","description":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets"},"relatedVulnerabilities":[{"id":"CVE-2026-119276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119276","cwe":"CWE-130","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-119276","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119276","date":"2026-11-09","epss":0.00351,"percentile":0.28973}],"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f","https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6","https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119276","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}]},{"artifact":{"id":"6391e5d014e0e341","cpes":["cpe:2.3:a:mariadb-java-client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java-client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*"],"name":"mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.5.10","type":"java-archive","version":"3.5.10","language":"java","licenses":["\"LGPL-2.1-or-later\""],"metadata":{"pomGroupID":"org.mariadb.jdbc","virtualPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","manifestName":"","pomArtifactID":"mariadb-java-client","archiveDigests":[{"value":"c6a687f7ccb65394103cd516e0583e61e6d92c24","algorithm":"sha1"}]},"locations":[{"path":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","layerID":"sha256:50ef5e5672edc7da8210365c8b7b67eff136135637f7ff4e5d55d008a12935f9","accessPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fhx5-2xqw-2cgm","versionConstraint":">=3.5.0,<3.5.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","version":"3.5.10"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fhx5-2xqw-2cgm","fix":{"state":"fixed","versions":["3.5.11"],"available":[{"date":"2026-10-31","kind":"first-observed","version":"3.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119210","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-119210","cwe":"CWE-73","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119210","date":"2026-11-09","epss":0.00303,"percentile":0.23226}],"risk":0.16513500000000003,"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm","https://nvd.nist.gov/vuln/detail/CVE-2026-119210","https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120","https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099","https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fhx5-2xqw-2cgm","description":"MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files"},"relatedVulnerabilities":[{"id":"CVE-2026-119210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119210","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-119210","cwe":"CWE-73","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119210","date":"2026-11-09","epss":0.00303,"percentile":0.23226}],"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120","https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099","https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119210","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}]},{"artifact":{"id":"6391e5d014e0e341","cpes":["cpe:2.3:a:mariadb-java-client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java-client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*"],"name":"mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.5.10","type":"java-archive","version":"3.5.10","language":"java","licenses":["\"LGPL-2.1-or-later\""],"metadata":{"pomGroupID":"org.mariadb.jdbc","virtualPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","manifestName":"","pomArtifactID":"mariadb-java-client","archiveDigests":[{"value":"c6a687f7ccb65394103cd516e0583e61e6d92c24","algorithm":"sha1"}]},"locations":[{"path":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","layerID":"sha256:50ef5e5672edc7da8210365c8b7b67eff136135637f7ff4e5d55d008a12935f9","accessPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-grfq-r75j-rw9x","versionConstraint":">=3.5.0,<3.5.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","version":"3.5.10"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-grfq-r75j-rw9x","fix":{"state":"fixed","versions":["3.5.11"],"available":[{"date":"2026-10-31","kind":"first-observed","version":"3.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119281","cwe":"CWE-838","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119281","date":"2026-11-09","epss":0.00283,"percentile":0.21001}],"risk":0.154235,"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x","https://nvd.nist.gov/vuln/detail/CVE-2026-119281","https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623","https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423","https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-grfq-r75j-rw9x","description":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing"},"relatedVulnerabilities":[{"id":"CVE-2026-119281","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119281","cwe":"CWE-838","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119281","date":"2026-11-09","epss":0.00283,"percentile":0.21001}],"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623","https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423","https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119281","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}]},{"artifact":{"id":"6391e5d014e0e341","cpes":["cpe:2.3:a:mariadb-java-client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java-client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java_client:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:org.mariadb.jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_java:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_java_client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb-java-client:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mariadb_java_client:3.5.10:*:*:*:*:*:*:*"],"name":"mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.5.10","type":"java-archive","version":"3.5.10","language":"java","licenses":["\"LGPL-2.1-or-later\""],"metadata":{"pomGroupID":"org.mariadb.jdbc","virtualPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","manifestName":"","pomArtifactID":"mariadb-java-client","archiveDigests":[{"value":"c6a687f7ccb65394103cd516e0583e61e6d92c24","algorithm":"sha1"}]},"locations":[{"path":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","layerID":"sha256:50ef5e5672edc7da8210365c8b7b67eff136135637f7ff4e5d55d008a12935f9","accessPath":"/opt/keycloak/lib/lib/main/org.mariadb.jdbc.mariadb-java-client-3.5.10.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4jq2-8v3c-97w8","versionConstraint":">=3.5.0,<3.5.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","version":"3.5.10"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4jq2-8v3c-97w8","fix":{"state":"fixed","versions":["3.5.11"],"available":[{"date":"2026-10-31","kind":"first-observed","version":"3.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119280","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-119280","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119280","date":"2026-11-09","epss":0.00306,"percentile":0.23549}],"risk":0.10250999999999999,"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8","https://nvd.nist.gov/vuln/detail/CVE-2026-119280","https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8","https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47","https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4jq2-8v3c-97w8","description":"MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths"},"relatedVulnerabilities":[{"id":"CVE-2026-119280","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119280","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-119280","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119280","date":"2026-11-09","epss":0.00306,"percentile":0.23549}],"urls":["https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8","https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47","https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119280","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}]}],"grade":"A","score":"100.00","as_of":"2026-11-10T18:28:41.521Z","grype_db_version":"2026-11-10T06:21:20.000Z"}