CVE-2026-55858

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9

Description The connector encodes and decodes protocol text and performs client-side escaping assuming the connection character set is UTF-8. A server can report a mid-session change to character set client through OK-packet session-state tracking, which can be triggered by SET NAMES commands, stored routines, triggers, server configuration, or a hostile server. If character set client changes to a non-UTF-8 value, the driver continues to use UTF-8 while the server interprets the bytes under a different encoding. This results in silent data corruption and a client/server charset-confusion mismatch, which can bypass byte-wise quoting or escaping and potentially lead to SQL injection.

Recommendations Update MariaDB Connector/J to version 2.7.14 or later. Update MariaDB Connector/J to version 3.3.5 or later. Update MariaDB Connector/J to version 3.4.3 or later. Update MariaDB Connector/J to version 3.5.9 or later.