CVE-2026-55859— MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb
Quick assessment
Affected
mariadb-corporation mariadb-connector-r2dbc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 1.4.1之前版本存在输出处理不当漏洞，该漏洞源于驱动程序在连接字符集为UTF-8的假设下编码和解码字符数据，服务器可通过OK-packet会话状态跟踪机制更改character_set_client，导致客户端与服务器字符集混淆，可能绕过字节级引用或转义，造成静默数据损坏。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mariadb-corporation | mariadb-connector-r2dbc | < 1.4.1 |
affected |
| org.mariadb | r2dbc-mariadb | < 1.4.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
MariaDB R2DBC connector 输出处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 1.4.1之前版本存在输出处理不当漏洞，该漏洞源于驱动程序在连接字符集为UTF-8的假设下编码和解码字符数据，服务器可通过OK-packet会话状态跟踪机制更改character_set_client，导致客户端与服务器字符集混淆，可能绕过字节级引用或转义，造成静默数据损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-r2dbc | < 1.4.1 | - |
|
| org.mariadb | r2dbc-mariadb | < 1.4.1 | - |
|
II. Public POCs for CVE-2026-55859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55859
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55859 (1)
Vendor Advisories for CVE-2026-55859 (1)
Vendor Pages for CVE-2026-55859 (1)
Other References for CVE-2026-55859 (1)
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55215 | 7.5 HIGH | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: |
| CVE-2026-55855 | 6.5 MEDIUM | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/ |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55856 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake |
| CVE-2026-55860 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clea |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
| CVE-2026-55858 | 5.9 MEDIUM | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb |
IV. Related Vulnerabilities
Same vendor: mariadb-corporation
-
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protoco -
CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys -
CVE-2026-107383
MariaDB Connector/Node.js exposes uninitialized process memo -
CVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the cl -
CVE-2026-61700
MariaDB Connector/J does not enforce allowLocalInfile=false
Same weakness: CWE-116
-
CVE-2026-110592
BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invo -
CVE-2026-102235
Visual Studio Code Remote Code Execution Vulnerability -
CVE-2026-107823
MariaDB: privilege escalation via incorrect view frm parsing -
CVE-2026-105244
Apache log4net: RemoteSyslogAppender silently deletes non-AS -
CVE-2026-106444
Handlebars: JavaScript Injection via Unsafe Inline Embedding
V. Comments for CVE-2026-55859
No comments yet