DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55858: CVE-2026-55858: Client/Server Charset-Confusion SQL Injection in MariaDB Connector/J

#security #cve #cybersecurity

CVE-2026-55858: Client/Server Charset-Confusion SQL Injection in MariaDB Connector/J

Vulnerability ID: CVE-2026-55858
CVSS Score: 5.9
Published: 2026-08-28

CVE-2026-55858 describes a critical encoding desynchronization vulnerability in MariaDB Connector/J (the official JDBC driver). The vulnerability stems from a mismatch between the driver's static UTF-8 client-side escaping logic and dynamic character set changes initiated on the database server. When the server character set is switched mid-session to an encoding that permits ASCII-overlapping multibyte characters (such as GBK or Big5), an attacker can supply crafted inputs to swallow escaping backslashes, resulting in SQL injection and unauthorized statement execution.

TL;DR

MariaDB Connector/J assumes the connection charset remains UTF-8. If a server-side charset switch (e.g., via 'SET NAMES') changes this to a non-UTF-8 multibyte charset (like GBK), the client's escaping logic can be bypassed using backslash-swallowing techniques, allowing SQL injection.

⚠️ Exploit Status: POC

Technical Details

  • Vulnerability ID: CVE-2026-55858 / GHSA-xvr9-35cr-46v9
  • CWE ID: CWE-838: Inappropriate Encoding for Output Context
  • CVSS v3.1 Score: 5.9 (Medium)
  • Attack Vector: Network (AV:N)
  • Attack Complexity: High (AC:H)
  • Exploit Status: Proof of Concept (PoC) available
  • CISA KEV Status: Not Listed

Affected Systems

  • Applications utilizing MariaDB Connector/J (mariadb-java-client) running against MySQL or MariaDB database servers with multibyte character configurations.
  • mariadb-connector-j: < 2.7.14 (Fixed in: 2.7.14)
  • mariadb-connector-j: >= 3.0.0-alpha, < 3.3.5 (Fixed in: 3.3.5)
  • mariadb-connector-j: >= 3.4.0, < 3.4.3 (Fixed in: 3.4.3)
  • mariadb-connector-j: >= 3.5.0, < 3.5.9 (Fixed in: 3.5.9)

Code Analysis

Commit: 300716b

Enforce charset verification during context and socket handling.

Commit: c555c9b

Track session state variables and close connection on non-utf8 updates.

Exploit Details

  • MariaDB JIRA Bug Tracker: CONJ-1317 contains core bug tracking reports detailing regression test cases and structural PoC mechanisms.

Mitigation Strategies

  • Upgrade the MariaDB Connector/J dependency to a patched version immediately.
  • Enforce strict server-side configuration parameters to disallow non-UTF-8 client session charsets.
  • Restrict user permissions on the execution of the SET NAMES statement in the database engine.

Remediation Steps:

  1. Identify all internal applications and services utilizing the 'org.mariadb.jdbc:mariadb-java-client' dependency.
  2. Update Maven, Gradle, or manual build configurations to reference one of the patched versions: 2.7.14, 3.3.5, 3.4.3, or 3.5.9.
  3. Rebuild and redeploy the affected applications into staging environment and execute regression suite.
  4. Deploy the updated application build to production environments and verify that dynamic charset configuration modifications are blocked and result in a SQLNonTransientConnectionException.

References

Read the full report for CVE-2026-55858 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)