{"id":"CVE-2026-55858","aliases":["EUVD-2026-68021","GHSA-g9jj-cgmh-9f38","GHSA-qxvw-fvwx-5cp7","GHSA-xvr9-35cr-46v9","RHLW-2026-7e41b237dd570c9f"],"status":"published","title":"MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00873,"percentile":0.59169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-838"],"published":"2026-08-28T22:46:40Z","modified":"2026-10-28T11:15:04Z","fixes":[{"ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","fixed_in":["2.7.14","3.3.5","3.4.3","3.5.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.9"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.14"}]}],"versions":["1.1.10","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.0-beta-1","1.3.0-beta-2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4.0","1.4.0-beta-1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0-RC1","1.5.1-RC","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","2.0.0-RC","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.5"}]}],"versions":["3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4"]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}],"versions":["3.4.0","3.4.1","3.4.2"]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.9"}]}],"versions":["3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.8.rhlw-00003"}]}],"versions":["1.1.10","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.0-beta-1","1.3.0-beta-2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4.0","1.4.0-beta-1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0-RC1","1.5.1-RC","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","2.0.0-RC","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0-alpha","3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8"],"bundled":3}],"products":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j"}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9","tags":["x_refsource_MISC","web"]},{"url":"https://jira.mariadb.org/browse/CONJ-1317","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-xvr9-35cr-46v9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55858.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55858","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55856.json","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-g9jj-cgmh-9f38","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55856","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/149ec6a626376214966c01f42d48be1b80d06056","tags":["fix"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/d90b9872322c76b05a48219be66bff1d33102f8a","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-g9jj-cgmh-9f38","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55857.json","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-qxvw-fvwx-5cp7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55857","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388","tags":["fix"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-qxvw-fvwx-5cp7","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55858","title":"MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.","status":"published","published":"2026-08-28T22:46:40.114Z","modified":"2026-09-01T02:06:07.389Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-68021","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.","status":"published","published":"2026-08-28T22:46:40Z","modified":"2026-09-01T02:06:07Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:19.285273Z"}],"ghsa":[{"id":"GHSA-xvr9-35cr-46v9","title":"org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context","description":"### Summary\n\nThe connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.\n\n### Details\n\nThe driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. \nCharset can be changed by commands like SET NAMES... commands.\n\nIf the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.\n\n### Impact\n\nSilent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.\n\n### Patches\n\nFixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises a SQLException with SQLState 08000 (connection exception) and closes the connection rather than continuing to exchange data under a mismatched encoding.\n\n### Workarounds\n\nThere is no reliable application-level workaround.\n\n### Credit\n\nReported by Yalguun Tumenkhuu ([@fg0x0](https://github.com/fg0x0/)).","status":"published","published":"2026-08-28T22:47:19Z","modified":"2026-08-28T22:47:20Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T14:41:08.084849Z"}],"nvd":[{"id":"CVE-2026-55858","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.","status":"published","published":"2026-08-28T23:17:08.827Z","modified":"2026-09-08T21:08:37.32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-55858","title":"MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.","status":"published","published":"2026-08-28T22:46:40.114Z","modified":"2026-10-28T11:15:04.664661779Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"GHSA-xvr9-35cr-46v9","title":"org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context","description":"### Summary\n\nThe connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.\n\n### Details\n\nThe driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. \nCharset can be changed by commands like SET NAMES... commands.\n\nIf the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.\n\n### Impact\n\nSilent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.\n\n### Patches\n\nFixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises a SQLException with SQLState 08000 (connection exception) and closes the connection rather than continuing to exchange data under a mismatched encoding.\n\n### Workarounds\n\nThere is no reliable application-level workaround.\n\n### Credit\n\nReported by Yalguun Tumenkhuu ([@fg0x0](https://github.com/fg0x0/)).","status":"published","published":"2026-08-28T22:47:19Z","modified":"2026-09-10T03:51:14.914708998Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"RHLW-2026-7e41b237dd570c9f","title":"Lightwell Security Advisory: mariadb-java-client 3.5.8.rhlw-00003","description":"Red Hat Lightwell has released org.mariadb.jdbc:mariadb-java-client 3.5.8.rhlw-00003 with backported fixes for CVE-2026-55856, CVE-2026-55857, and CVE-2026-55858.\n\nCVE-2026-55856: MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake\n\nCVE-2026-55857: MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials\n\nCVE-2026-55858: MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client\n\nThis patched artifact is a drop-in replacement for org.mariadb.jdbc:mariadb-java-client 3.5.8 from Maven Central.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-27T04:00:08.778171283Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"}]}}