{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"},"package":{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.7.14"}],"type":"ECOSYSTEM"}],"versions":["1.1.10","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.0-beta-1","1.3.0-beta-2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4.0","1.4.0-beta-1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0-RC1","1.5.1-RC","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","2.0.0-RC","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"},"package":{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.3.5"}],"type":"ECOSYSTEM"}],"versions":["3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"},"package":{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}],"type":"ECOSYSTEM"}],"versions":["3.4.0","3.4.1","3.4.2"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"},"package":{"ecosystem":"Maven","name":"org.mariadb.jdbc:mariadb-java-client","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"events":[{"introduced":"3.5.0"},{"fixed":"3.5.9"}],"type":"ECOSYSTEM"}],"versions":["3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8"]}],"aliases":["CVE-2026-55858"],"database_specific":{"cwe_ids":["CWE-838"],"github_reviewed":true,"github_reviewed_at":"2026-08-28T22:47:19Z","nvd_published_at":null,"severity":"MODERATE"},"details":"### Summary\n\nThe connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.\n\n### Details\n\nThe driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. \nCharset can be changed by commands like SET NAMES... commands.\n\nIf the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.\n\n### Impact\n\nSilent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.\n\n### Patches\n\nFixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises a SQLException with SQLState 08000 (connection exception) and closes the connection rather than continuing to exchange data under a mismatched encoding.\n\n### Workarounds\n\nThere is no reliable application-level workaround.\n\n### Credit\n\nReported by Yalguun Tumenkhuu ([@fg0x0](https://github.com/fg0x0/)).","id":"GHSA-xvr9-35cr-46v9","modified":"2026-09-10T03:51:14.914708998Z","published":"2026-08-28T22:47:19Z","references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607"},{"type":"PACKAGE","url":"https://github.com/mariadb-corporation/mariadb-connector-j"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9"},{"type":"WEB","url":"https://jira.mariadb.org/browse/CONJ-1317"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"}],"summary":"org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context"}