CVE-2026-55858

Received Received - Intake

MariaDB Connector/J Character Set Confusion Vulnerability

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55858

Affected Vendors & Products

Vendor	Product	Version / Range
mariadb	mariadb_connector_j	2.7.14
mariadb	mariadb_connector_j	3.3.5
mariadb	mariadb_connector_j	3.4.3
mariadb	mariadb_connector_j	3.5.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-838	The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

Attack-Flow Graph

Executive Summary

MariaDB Connector/J versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9 incorrectly assume the database connection uses UTF-8 encoding for all operations. If the server changes the character set mid-session to a non-UTF-8 value, the driver continues processing data as UTF-8 while the server interprets it differently. This mismatch can cause silent data corruption and bypass security checks like quoting or escaping.

Detection Guidance

Detect this vulnerability by checking the version of MariaDB Connector/J in use. If it is below 2.7.14, 3.3.5, 3.4.3, or 3.5.9, the system is vulnerable. Commands like 'mvn dependency:tree' for Java projects or inspecting the connector JAR file version can help identify the installed version.

Impact Analysis

This vulnerability may lead to data corruption, unauthorized data access, or application crashes. Attackers could exploit it to manipulate data by sending specially crafted inputs that bypass security controls, potentially leading to data breaches or integrity issues in applications using affected MariaDB Connector/J versions.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and security, such as GDPR's accuracy principle or HIPAA's integrity safeguards. Data corruption or unauthorized access risks may lead to non-compliance, potential fines, or legal consequences if sensitive data is compromised.

Mitigation Strategies

Upgrade MariaDB Connector/J to a patched version (2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later). Review database configurations and stored routines to ensure no mid-session changes to character_set_client occur. Test the upgrade in a non-production environment before full deployment.

Hi! I’m here to help you understand CVE-2026-55858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70