5.9

CVE-2026-55858: MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client

Awaiting analysis
AliasesCGA-2248-3v8w-8ff7CGA-28mw-v34h-m498CGA-46vm-cghw-826p
Published 28-08-2026Last modified 01-09-2026

Vulnerability summary

CVE-2026-55858 is a medium (CVSS 5.9) vulnerability in mariadb-corporation mariadb-connector-j. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.87%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-RM7P-VR95-GRW6

Timeline

  1. 28-08-2026
    PublishedVulnerability first disclosed.
  2. 01-09-2026
    Last modifiedVulnerability information updated.

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.87%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.87% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard32 products
  • airbyte-platform-fips-server< 2.0.0-r7
  • airbyte-platform-server< 2.0.0-r5
  • airbyte-serverAll versions (No fix recorded)
  • airbyte-server-fipsAll versions (No fix recorded)
  • camunda-8.8< 8.8.36-r1
Wolfi13 products
  • debezium-3.4< 3.4.3-r8
  • debezium-3.4-connect-compat< 3.4.3-r8
  • debezium-3.4-connector-jdbc< 3.4.3-r7
  • debezium-3.4-connector-mariadb< 3.4.3-r7
  • debezium-3.4-connectors-all< 3.4.3-r8
Mariadb-corporation1 product
  • mariadb-connector-j< 2.7.14 | ≥ 3.0.0-alpha, < 3.3.5 | ≥ 3.4.0, < 3.4.3 | ≥ 3.5.0, < 3.5.9
Org.mariadb.jdbc1 product
  • mariadb-java-client< 2.7.14 | ≥ 3.0.0, < 3.3.5 | ≥ 3.4.0, < 3.4.3 | ≥ 3.5.0, < 3.5.9

4 vendors · 47 products

References

13 links
Show all 13 references