Skip to contentMariadb-corporation vulnerabilities
Newest
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingCVE-2026-119281Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsCVE-2026-119280Fix available3.7 Low
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsCVE-2026-119279Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationCVE-2026-119278Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengthsCVE-2026-1192775.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsCVE-2026-119276Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client filesCVE-2026-119210Fix available5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESCVE-2026-107385Fix available7.4 High
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)CVE-2026-107384Fix available8.1 High
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersCVE-2026-107383Fix available7.5 High
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSCVE-2026-107382Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsCVE-2026-61700Fix available3.7 Low
- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 moreMariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)CVE-2026-55860Fix available5.9 Medium
- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 moreMariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbCVE-2026-55859Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientCVE-2026-55858Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsCVE-2026-55857Fix available5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeCVE-2026-55856Fix available5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsCVE-2026-55855Fix available6.5 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbCVE-2026-55854Fix available5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`CVE-2026-55215Fix available7.5 High