CVE-2026-55858— MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client
Quick assessment
Affected
mariadb-corporation mariadb-connector-j
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB Connector/J 用于将 Java 应用连接到 MariaDB 和 MySQL 数据库。在 2.7.14、3.3.5、3.4.3 和 3.5.9 之前，该连接器在编码和解码协议文本以及执行客户端转义时，假设连接的字符集为 UTF-8。服务器可以通过 OK 数据包中的会话状态跟踪，报告会话期间 的变更，这些变更可能由 语句、存储过程或触发器、服务器配置或恶意服务器引起。如果 变为非 UTF-8 值，驱动程序将继续以 UTF-8 读写数据，而服务器则以另一种编码解释相同的字节流，从而导致静默的数据
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55858
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出上下文语义编码不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-j | < 2.7.14 | - |
|
II. Public POCs for CVE-2026-55858
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55858
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55858 (4)
Vendor Advisories for CVE-2026-55858 (1)
Vendor Pages for CVE-2026-55858 (4)
Other References for CVE-2026-55858 (1)
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55215 | 7.5 HIGH | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: |
| CVE-2026-55855 | 6.5 MEDIUM | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/ |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55856 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake |
| CVE-2026-55860 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clea |
| CVE-2026-55859 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
IV. Related Vulnerabilities
Same vendor: mariadb-corporation
-
CVE-2026-55860
MariaDB Connector/R2DBC: Cleartext password disclosure to a -
CVE-2026-55859
MariaDB Connector/R2DBC: Inappropriate Encoding for Output C -
CVE-2026-55857
MariaDB Connector/J: Cleartext Transmission of Sensitive Inf -
CVE-2026-55856
MariaDB Connector/J: Cleartext password disclosure to a MITM -
CVE-2026-55855
MariaDB Connector/Node.js: Possible SQL injection in Buffer
Same weakness: CWE-838
V. Comments for CVE-2026-55858
No comments yet