CVE-2026-107819: mariadb server

Vulnerability summary

CVE-2026-107819 is a medium (CVSS 5.9) vulnerability in mariadb server. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

• CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.