MariaDB Connector/R2DBC CVE-2026-55859
MEDIUM
GHSA-5rqc-86vf-g8r2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Server-side control or MitM required (AC:H); client needs no privileges (PR:N); impact is integrity-only via encoding confusion, with no confidentiality or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 maven packages depend on org.mariadb:r2dbc-mariadb (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.4.1.
DescriptionCVE.org
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.
AnalysisAI
MariaDB Connector/R2DBC prior to 1.4.1 hardcodes UTF-8 for all character encoding and decoding but fails to reject mid-session charset changes announced by the server via the OK-packet session-state-tracking mechanism. A hostile or man-in-the-middle server, or server-side constructs such as stored routines, triggers, or server configuration, can shift character_set_client to a non-UTF-8 encoding after connection initialization, causing the driver and server to interpret identical bytes under different encodings. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of three server-side triggering conditions: (1) a hostile or man-in-the-middle server that injects a forged OK-packet containing a character_set_client session-state change to a non-UTF-8 charset (e.g., GBK, BIG5, latin1) after the connection initialization phase completes; (2) a stored routine or trigger on the MariaDB/MySQL server that executes SET NAMES with a non-UTF-8 charset during a session; or (3) server configuration that alters character_set_client mid-session via session-state-tracking. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the exploitation profile: network-accessible attack vector, high attack complexity due to the requirement for server-side control or man-in-the-middle positioning, no required client privileges, and high integrity impact without confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.4.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mariadb Connector R2Dbc
View allSame weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today