Bug 2525815 (CVE-2026-55858) - CVE-2026-55858 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch
Summary: CVE-2026-55858 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Sil...
Keywords:
Status: NEW
Alias: CVE-2026-55858
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2527771 2527772 2527775 2527776 2527777 2527778 2527779 2527781 2527782 2527783 2527784 2527785 2527787 2527788 2527789 2527773 2527774 2527786
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-28 22:51 UTC by OSIDB Bzimport
Modified: 2026-09-02 20:54 UTC (History)
65 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-28 22:51:25 UTC
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.


Note You need to log in before you can comment on or make changes to this bug.