MariaDB Connector/Java 3.5.9: fixes for local file read, cert verification, and auth flaws

MariaDB Connector/Java 3.5.9 Release Notes Vulnerability Overview CONJ-1320: PAM (dialog) authentication must verify the secure connection (reported by fgx03) CONJ-1319: Use constant-time comparison to verify server certificate fingerprints (reported by jineswa-coder) CONJ-1318: Enforce the option when the server issues a local initialization request, preventing malicious servers from reading client files CONJ-1322: Case-insensitive matching for local infile filenames (credit to jineswa-coder) CONJ-1323: validation rejects statements that start with a line comment (credit to sebdemdev) CONJ-1324: Parsing limits for strings to prevent CPU exhaustion (reported by tonghuaroot) CONJ-1317: Non-UTF8 characters cannot be used for protocol exchange (reported by fgx03) CONJ-1304: Ensure metadata reading when MySQL fallback occurs CONJ-1309: When rewriting batches, preserve the VALUES literal after the last placeholder CONJ-1311: fails when client socket IP is set along with CONJ-1312: Race condition in can lead to NPE CONJ-1316: treated as a CONJ-1324: Fixed SQL parser to correctly handle expressions and reset after block comments CONJ-1323: validation rejects statements that start with a line comment (credit to sebdemdev) Affected Scope CONJ-1323: Cache the TLS trust key manager to reduce SSL connection cost CONJ-1314: Add SPI for interactive dialog (PAM) authentication callbacks CONJ-1311: Add dedicated option for query cancellation CONJ-1310: Add native image support and CI verification Fix Details All the issues listed above are fixed in MariaDB Connector/Java version 3.5.9 Released version: 3.5.9 (June 2026) Commit hash: Released by: dbart

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/Java 3.5.9: fixes for local file read, cert verification, and auth flaws

More from this source