DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55859: CVE-2026-55859: Client-Server Charset Confusion in MariaDB Connector/R2DBC leading to SQL Injection

#security #cve #cybersecurity

CVE-2026-55859: Client-Server Charset Confusion in MariaDB Connector/R2DBC leading to SQL Injection

Vulnerability ID: CVE-2026-55859
CVSS Score: 5.9
Published: 2026-08-28

An input validation and encoding desynchronization vulnerability exists in MariaDB Connector/R2DBC versions prior to 1.4.1. The driver assumes all communication utilizes the UTF-8 character set, but fails to account for server-driven mid-session changes to the character_set_client variable. When a change to a multi-byte character set such as GBK or Big5 is induced, the server interprets client-escaped single quotes as part of a multi-byte character. This state desynchronization bypasses standard escaping mechanisms and allows remote unauthenticated attackers to execute arbitrary SQL commands.

TL;DR

A charset desynchronization vulnerability in MariaDB Connector/R2DBC allows attackers to bypass SQL character escaping and execute arbitrary database queries.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-116, CWE-838
  • Attack Vector: Network
  • Complexity: High
  • CVSS Score: 5.9
  • Impact: Integrity (SQL Injection)
  • Exploit Status: Conceptual / PoC
  • KEV Status: Not Listed

Affected Systems

  • MariaDB Connector/R2DBC
  • MariaDB Connector/R2DBC: < 1.4.1 (Fixed in: 1.4.1)

Code Analysis

Commit: 38bad9a

[misc] ensure non utf8 charset cannot be used for exchanges

Mitigation Strategies

  • Upgrade MariaDB Connector/R2DBC to version 1.4.1 or higher.
  • Enforce TLS (sslMode=VERIFY_CA/VERIFY_FULL) to prevent MITM charset-tracking packet modification.
  • Restrict execution of stored procedures and triggers that modify server variables dynamically.

Remediation Steps:

  1. Identify any Maven or Gradle dependency references to org.mariadb:r2dbc-mariadb.
  2. Update dependency version declaration to 1.4.1 or higher.
  3. Deploy application with upgraded libraries.
  4. Configure database connection pools to enforce TLS verification to counter MITM vectors.

References

Read the full report for CVE-2026-55859 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)