CVE-2026-55858

A flaw was found in MariaDB Connector/J, a component used to connect Java applications to MariaDB and MySQL databases. The connector incorrectly assumes a UTF-8 character set for communication, even if the database server changes its client character set to a non-UTF-8 value during a session. This mismatch can lead to silent data corruption, where data is written and read incorrectly, and may also allow attackers to bypass security mechanisms like byte-wise quoting or escaping.

MariaDB Connector/J (org.mariadb.jdbc:mariadb-java-client) encodes and decodes the wire protocol and performs client-side escaping assuming a UTF-8 connection character set. If the server signals a mid-session change of character_set_client to a non-UTF-8 value (via SET NAMES, a stored routine or trigger, server configuration, or a hostile server), the driver continues to read and write UTF-8 while the server interprets those bytes under another encoding, causing silent data corruption and potentially defeating byte-wise quoting or escaping. Red Hat rates the impact of this flaw as Moderate: exploitation requires either a hostile/compromised server or a server-side configuration that changes the client character set mid-session, and the primary consequence is to data integrity rather than confidentiality or availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade MariaDB Connector/J to a fixed version (2.7.14, 3.3.5, 3.4.3, or 3.5.9, as appropriate for the branch in use), which rejects any post-initialization character set other than utf8, utf8mb3, or utf8mb4 and closes the connection. Where upgrading is not immediately possible, avoid changing character_set_client after connection establishment and connect only to trusted database servers.