Information Disclosure in mariadb (CVE-2026-107383)
Summary
Vulnerability in mariadb (CVE-2026-107383). Confidential information can be exposed externally. Mitigation: upgrade to 3.5.4 or later.
Original description
The description as published by the source.
Description
When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {"length": 4000}) still reserved 4 + 16 * length bytes, but wrote none of them. The buffer came from Buffer.allocUnsafe() and was returned in full regardless of how far the write position had advanced, so every reserved-but-unwritten byte was uninitialized Node.js heap.
The sibling LineString case handled this correctly, aborting with null on the first malformed point, so no reserved byte could escape unwritten.
The only gate on this path is value.type naming a GeoJSON type, so any object shaped like {"type": "Polygon", ...} reached the encoder.
Impact
An application that passes an attacker-influenced object as a parameter to execute() or batch() writes uninitialized process memory into the database, where it is readable by anyone who can read that row and persists into backups and replicas. Applications accepting GeoJSON for map or location features are the natural case, as the attacker controls coordinates directly.
The disclosed memory is not scoped to the requesting user: in a shared Node.js process the heap may hold other users' request and response bodies, session tokens and cookies, database credentials and TLS key material. The leak is si…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-107383 has been found in mariadb.
Confidential information can be exposed externally. CVSS score: 7.5/10.
What to do: upgrade mariadb to 3.5.4 or later.
If unsure, ask your IT team or search "mariadb CVE-2026-107383" on the vendor's site.
CVE-2026-107383 (mariadb) — CWE-200 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 3.5.4 — apply immediately
Workaround: Validate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter, or use query(), until upgraded.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Information disclosure (CWE-200) exists in mariadb.
Check the vendor advisory for the affected versions of mariadb.
Severity: High (CVSS 7.5/10). Confidential information can be exposed externally.
Update to 3.5.4.
Workaround: Validate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter, or use query(), until upgraded.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'mariadb' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'mariadb' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
mariadbを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Validate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter, or use query(), until upgraded.パッチが適用されるまでの応急処置として、Validate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter, or use query(), until upgraded. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade mariadb to 3.5.4ステージング環境で 3.5.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web github.com