CVE-2026-55858: MariaDB Connector/J Charset Confusion Flaw

CVE-2026-55858 Overview

CVE-2026-55858 is a charset-confusion vulnerability in MariaDB Connector/J, the JDBC driver used by Java applications to connect to MariaDB and MySQL databases. The driver assumes UTF-8 for encoding and client-side escaping, but the server can signal a mid-session change to character_set_client through OK-packet session-state tracking. When the driver continues emitting UTF-8 bytes while the server reinterprets them under a different encoding, byte-wise quoting and escaping routines can be defeated. The flaw is tracked as [CWE-838] (Inappropriate Encoding for Output Context) and affects versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Critical Impact
A hostile or misconfigured server, or a SET NAMES statement issued from a stored routine or trigger, can force silent data corruption and defeat client-side escaping, enabling SQL injection primitives against Java applications using vulnerable driver versions.

Affected Products

MariaDB Connector/J versions prior to 2.7.14
MariaDB Connector/J 3.x versions prior to 3.3.5, 3.4.3, and 3.5.9
Java applications connecting to MariaDB or MySQL databases through the affected driver

Discovery Timeline

2026-08-28 - CVE-2026-55858 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55858

Vulnerability Analysis

MariaDB Connector/J encodes outbound protocol text and performs client-side escaping under a fixed assumption that the connection character set is UTF-8. The MariaDB/MySQL wire protocol allows the server to advertise session-state changes inside OK packets, including a change to character_set_client. Triggers for this change include SET NAMES, stored routines, server configuration reloads, or a hostile server response.

When character_set_client shifts to a non-UTF-8 encoding, the driver continues writing UTF-8 bytes while the server parses those bytes under an alternate charset. This asymmetry produces two concrete consequences: silent data corruption during read and write operations, and a break in the client/server charset contract that client-side escaping depends on. Byte-wise quoting can therefore fail to neutralize metacharacters, opening a path to SQL injection even when parameterized code uses driver-provided escaping.

Root Cause

The root cause is missing enforcement of a charset invariant after connection initialization. The driver's Context.setCharset method accepted arbitrary charset values reported by the server without validating compatibility with the driver's UTF-8 encoding path. No gate existed to reject unsafe post-initialization charset transitions.

Attack Vector

Exploitation requires network-adjacent conditions such as a compromised or malicious database server, a man-in-the-middle capable of injecting server responses, or execution of untrusted SQL that triggers SET NAMES or invokes a stored routine that mutates character_set_client. Once the mismatch is established, subsequent statements from the driver are re-parsed by the server under the attacker-controlled encoding.

java

// Patch: Context.setCharset now throws when a non-UTF-8 charset is signaled post-init
// Source: https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6

  String getCharset();

  /**
   * Indicate server charset change. Throws when the new charset isn't compatible with the driver's
   * UTF-8 assumption (only utf8 / utf8mb3 / utf8mb4 accepted post-init).
   *
   * @param charset server charset
   * @throws java.sql.SQLException if the change is rejected; the connection is also closed
   */
  void setCharset(String charset) throws java.sql.SQLException;

  /**
   * Indicate that connection setup is complete; subsequent {@link #setCharset(String)} calls are
   * gated and will reject non-utf8 values.
   */
  void setInitialized();

Source: MariaDB Connector/J commit 8cfd9df

A companion patch expands the tracked session variables to include character_set_client, ensuring the driver observes and reacts to server-side changes:

java

// Source: https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69

    if ((serverCapabilities & MariaDbServerCapabilities.CLIENT_SESSION_TRACK) != 0) {
      if (options.rewriteBatchedStatements) {
        sessionOption.append(
            ", session_track_system_variables='auto_increment_increment,character_set_client' ");
      }
    }

Detection Methods for CVE-2026-55858

Indicators of Compromise

Application logs showing SQLException with SQLState 08000 after upgrading to a patched driver, indicating a rejected charset change
Database audit logs recording unexpected SET NAMES statements or stored routines that modify character_set_client
Corrupted string data in tables written by Java services using MariaDB Connector/J
Unexpected connection terminations correlated with server-side session-state tracking events

Detection Strategies

Inventory Java build artifacts (Maven, Gradle) for mariadb-java-client versions below 2.7.14, 3.3.5, 3.4.3, or 3.5.9
Enable MariaDB general query logging or audit plugin to capture statements that alter character_set_client mid-session
Review stored procedures and triggers for embedded SET NAMES or SET character_set_client statements
Monitor for anomalous downstream database traffic patterns following a session-state tracker update

Monitoring Recommendations

Alert on any occurrence of SQLState 08000 originating from JDBC connection pools after the patch is deployed
Correlate database server session-tracking events with application-tier query anomalies
Track outbound JDBC connections to database endpoints outside the expected inventory to detect hostile-server scenarios

How to Mitigate CVE-2026-55858

Immediate Actions Required

Upgrade MariaDB Connector/J to 2.7.14, 3.3.5, 3.4.3, or 3.5.9 depending on your major version branch
Audit database servers and stored routines for statements that alter character_set_client post-connection
Restrict database connectivity so Java applications only reach trusted, authenticated database instances
Enforce TLS for all JDBC connections to prevent injection of session-state responses by network attackers

Patch Information

The fix accepts only utf8, utf8mb3, or utf8mb4 after connection initialization. Any other value causes a SQLException with SQLState 08000 and closes the connection. Patched releases are available at MariaDB Release 2.7.14, MariaDB Release 3.3.5, MariaDB Release 3.4.3, and MariaDB Release 3.5.9. Full details are in GHSA-xvr9-35cr-46v9 and JIRA CONJ-1317.

Workarounds

Where immediate patching is not possible, ensure database servers, stored routines, and triggers do not execute SET NAMES or otherwise mutate character_set_client
Enforce parameterized queries at the application layer and avoid relying solely on driver-provided escaping
Terminate JDBC connections through TLS with certificate pinning to reduce exposure to hostile-server responses

bash

# Maven dependency update example
mvn versions:use-dep-version -Dincludes=org.mariadb.jdbc:mariadb-java-client -DdepVersion=3.5.9 -DforceVersion=true

# Gradle dependency pin example
# build.gradle
# implementation 'org.mariadb.jdbc:mariadb-java-client:3.5.9'