MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

published 2026-08-28 2 mo ago modified 2026-09-08 2 mo ago also GHSA-5rqc-86vf-g8r2 , EUVD-2026-68022

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.

Patch / fix

fixed in 1 links 2

maven org.mariadb:r2dbc-mariadb 1.4.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-31)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.mariadb:r2dbc-mariadb	<1.4.1	1.4.1

Affected products

mariadb-corporation mariadb-connector-r2dbc
org.mariadb r2dbc-mariadb

Classification

Weakness

CWE-116 Improper Encoding or Escaping of Output
CWE-838 Inappropriate Encoding for Output Context

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary