MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 contain a vulnerability where a rogue or MitM server can cause the client to allocate large amounts of heap memory based on server-declared lengths in OK packets. This can lead to excessive garbage collection pressure and potentially an OutOfMemoryError, impacting availability. The flaw arises because the client allocates memory before validating that the declared lengths fit within the actual packet size. The issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.