CVE-2026-55859: MariaDB Connector/R2DBC Data Corruption Flaw

CVE-2026-55859 Overview

CVE-2026-55859 affects MariaDB Connector/R2DBC, a non-blocking MariaDB and MySQL client implemented in Java. Versions prior to 1.4.1 assume the connection character set is always UTF-8 when encoding and decoding character data. A server can announce a mid-session change to character_set_client via the OK-packet session-state-tracking mechanism. When the new charset is not UTF-8, the driver continues sending UTF-8 while the server interprets bytes under a different encoding. This mismatch causes silent data corruption and can defeat byte-wise quoting or escaping routines. The issue maps to Improper Encoding or Escaping of Output [CWE-116].

Critical Impact
A hostile or man-in-the-middle server can trigger charset confusion between client and server, defeating byte-wise escaping and enabling silent data corruption or injection.

Affected Products

org.mariadb:r2dbc-mariadb versions prior to 1.4.1
MariaDB Connector/R2DBC (Java non-blocking driver)
Applications using stored routines, triggers, or SET NAMES that alter character_set_client

Discovery Timeline

2026-08-28 - CVE-2026-55859 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55859

Vulnerability Analysis

The MariaDB Connector/R2DBC driver hardcodes UTF-8 as the encoding for all character data exchanged with the server. The MariaDB and MySQL wire protocol permits the server to advertise session-state changes, including updates to character_set_client, through OK-packet metadata. Such changes can originate from server configuration, SET NAMES executed inside stored routines or triggers, or from a hostile or man-in-the-middle server.

When the announced charset diverges from UTF-8, the driver does not adapt. It continues encoding parameters and SQL text as UTF-8 while the server decodes those bytes under a different encoding. Application-side escaping that operates on UTF-8 bytes can be neutralized, allowing crafted multi-byte sequences to alter SQL semantics after server-side decoding.

Root Cause

The driver lacks validation of server-announced charset changes after initialization. Character encoding assumptions are baked into the encoder and decoder paths, so the client and server can drift into inconsistent byte interpretations without any error being surfaced to the application.

Attack Vector

Exploitation requires a network-adjacent adversary controlling the database server, a proxy in the connection path, or the ability to influence server-side routines that emit charset changes. The attacker forces a non-UTF-8 charset mid-session, then submits input designed to bypass client-side escaping when reinterpreted by the server under the new encoding.

java

// Patch: mark client context as initialized before setting session variables
// so any subsequent non-UTF-8 charset switch is rejected.
// File: src/main/java/org/mariadb/r2dbc/MariadbConnectionFactory.java
    ConnectionProvider.newConnection(), endpoint, hostAddress, configuration, lock)
.delayUntil(client -> AuthenticationFlow.exchange(client, configuration, hostAddress))
.cast(Client.class)
.flatMap(
    client -> {
      client.getContext().setInitialized();
      return setSessionVariables(configuration, client).thenReturn(client);
    })
.onErrorMap(e -> cannotConnect(e, endpoint));

Source: GitHub Commit 38bad9a. After setInitialized() is called, the driver rejects any charset value other than utf8, utf8mb3, or utf8mb4 by raising R2dbcNonTransientResourceException with SQLState 08000 and closing the connection.

Detection Methods for CVE-2026-55859

Indicators of Compromise

Database sessions where character_set_client differs from utf8, utf8mb3, or utf8mb4 after authentication.
Unexpected SET NAMES statements originating from triggers, stored procedures, or server init scripts.
Application logs showing garbled or replacement characters in stored or retrieved data.

Detection Strategies

Inventory Java services and identify dependencies on org.mariadb:r2dbc-mariadb below version 1.4.1 using software composition analysis.
Enable server-side general query logging temporarily and alert on SET NAMES or SET character_set_client statements issued outside application code.
Compare byte-for-byte hashes of writes and subsequent reads for canary values in staging to identify silent charset corruption.

Monitoring Recommendations

Monitor for R2dbcNonTransientResourceException with SQLState 08000 after upgrading, which indicates rejected non-UTF-8 charset attempts.
Track outbound MariaDB and MySQL connections to unexpected hosts that could indicate MITM interception.
Alert on new or modified stored routines and triggers that manipulate session character sets.

How to Mitigate CVE-2026-55859

Immediate Actions Required

Upgrade org.mariadb:r2dbc-mariadb to version 1.4.1 or later in all affected Java services.
Audit database servers for stored routines, triggers, or init files that call SET NAMES with non-UTF-8 charsets.
Enforce TLS on all MariaDB and MySQL connections with certificate validation to prevent MITM downgrade of the character set.

Patch Information

The fix is available in MariaDB Connector/R2DBC 1.4.1. The driver now marks the client context as initialized after authentication and rejects any post-initialization charset value that is not utf8, utf8mb3, or utf8mb4. See the GitHub Security Advisory GHSA-5rqc-86vf-g8r2 and MariaDB JIRA R2DBC-124 for full details.

Workarounds

Restrict database server configuration so character_set_client, character_set_connection, and character_set_results default to utf8mb4 server-wide.
Remove or audit any stored procedures and triggers that invoke SET NAMES with non-UTF-8 encodings.
Require TLS with strict certificate validation to reduce the risk of a man-in-the-middle server injecting session-state changes.

bash

# Maven: pin the fixed connector version
mvn versions:use-dep-version \
  -Dincludes=org.mariadb:r2dbc-mariadb \
  -DdepVersion=1.4.1 \
  -DforceVersion=true

# Gradle: enforce fixed version in build.gradle
# implementation('org.mariadb:r2dbc-mariadb:1.4.1')