Skip to content
Fencer Vulns
medium 5.9

CVE-2026-55858 json

MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client

published 2026-08-28 2 mo ago modified 2026-09-10 1 mo ago also GHSA-xvr9-35cr-46v9 , EUVD-2026-68021

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Patch / fix

  • maven org.mariadb.jdbc:mariadb-java-client 2.7.14, 3.3.5, 3.4.3, 3.5.9

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-55858 updated cvss 5.9

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of Debezium 3 mariadb-java-client 3.5.3.redhat-00001 Red Hat Build of Keycloak rhbk/keycloak-rhel9, keycloak/rhbk-openshift-rhel9, mariadb-java-client 3.5.3.redhat-00001 Red Hat build of Quarkus mariadb-java-client 3.5.3.redhat-00001 Red Hat Enterprise Linux 8 Judy, galera, mariadb, mariadb-pam, mariadb-test, mariadb-backup, +8 more Red Hat Enterprise Linux 9 mariadb-java-client 3.4.0-2.el10 Red Hat Enterprise Linux 10 mariadb-java-client 3.4.0-2.el10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Fuse 7 mariadb-java-client 3.5.3.redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-trustyai-service-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift GitOps microshift-gitops, openshift-gitops-argocd-cli, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Satellite 6 candlepin, candlepin-selinux
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Single Sign-On 7 mariadb-java-client 3.5.3.redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel10 Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix available
show 2 more
  • Red Hat build of Quarkus 3.27.6.redhat mariadb-java-client 3.5.9.redhat-00001
    fixed: vendor fix RHSA-2026:83082
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator Red Hat build of Quarkus 3.27.6.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat Enterprise Linux 8 Judy, galera, grafana, mariadb, mozjs60, mariadb-pam, +23 more Red Hat Enterprise Linux 9 npm, nodejs, grafana, nodejs-libs, grafana-selinux, nodejs-full-i18n Red Hat Enterprise Linux 10 grafana, nodejs22, nodejs24, nodejs26 Red Hat Hardened Images yarnpkg, nodejs20, nodejs22, nodejs24, nodejs25, nodejs26, +7 more
    +2 more products
    Red Hat Trusted Artifact Signer rhtas/rhtas-console-ui-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.mariadb.jdbc:mariadb-java-client
<2.7.14
>=3.0.0, <3.3.5
>=3.4.0, <3.4.3
>=3.5.0, <3.5.9
2.7.14
3.3.5
3.4.3
3.5.9

Affected products

  • mariadb-corporation mariadb-connector-j

Classification

Weakness
  • CWE-838 Inappropriate Encoding for Output Context

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.