CVE-2026-107819

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107819
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107819.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107819
Aliases
  • GHSA-fmq9-qjxj-qpf7
Downstream
Published
2026-10-09T17:25:45Z
Modified
2026-10-28T10:51:15Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
Details

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-297"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107819.json"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-c

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-c
Events
Introduced
de6305915f86bb33c83b1fe782a2b8a76920aec1
Fixed
8153da40fe720b1d25db12aa3f993918da15bd3b
Fixed
e8c0a16d94ddf844668d684a7d42b37ac8e0fc02
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.4.1"
                },
                {
                    "fixed":  "3.4.10"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "e8c0a16d94ddf844668d684a7d42b37ac8e0fc02"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v3.4.10",
            "range":  [
                {
                    "fixed":  "8153da40fe720b1d25db12aa3f993918da15bd3b"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v3.*
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.6
v3.4.7
v3.4.8
v3.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107819.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "49926995115306452506150328668827550922",
                "21680598738414608729318342151702517251",
                "27901823345030361362269905591239365654",
                "290059996277261289332794766215132327788",
                "220263496024370897040820980750128952618",
                "206345309748933763595717261161876419924",
                "5152760896604591288773671180479975118",
                "262907106771466566532812920316146350856",
                "195547006939694085069267556822870882257"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107819-1d6fe11f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
        "target":  {
            "file":  "plugins/auth/my_auth.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "249726968211302489602923545727773800479",
            "length":  1272
        },
        "id":  "CVE-2026-107819-4394f37e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/8153da40fe720b1d25db12aa3f993918da15bd3b",
        "target":  {
            "file":  "unittest/libmariadb/ps.c",
            "function":  "test_vector"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "119395872767643541814227181962632948200",
            "length":  1630
        },
        "id":  "CVE-2026-107819-62f18e79",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
        "target":  {
            "file":  "libmariadb/mariadb_lib.c",
            "function":  "mysql_init"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "134587052742145015964208557316791499359",
            "length":  2557
        },
        "id":  "CVE-2026-107819-6cc7499e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
        "target":  {
            "file":  "libmariadb/ma_tls.c",
            "function":  "ma_pvio_tls_verify_server_cert"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "338096637639934456023479377172249681586",
            "length":  4776
        },
        "id":  "CVE-2026-107819-81aaae3f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
        "target":  {
            "file":  "plugins/auth/my_auth.c",
            "function":  "run_plugin_auth"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "85510151422084730106219661091802829967",
                "126783520968535468199114467787225695935",
                "78474443796110510982674562855084677873",
                "81512620604195697893021914197246900099"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107819-992fb3fb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
        "target":  {
            "file":  "libmariadb/mariadb_lib.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "86136382036198362328304138461648284772",
                "251365011128251190761614491571380299936",
                "257858115413623363667848754794799814880",
                "39521776064039430727668613822278742842"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107819-cf066478",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
        "target":  {
            "file":  "libmariadb/ma_tls.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "335824217201172825678247368787400597043",
                "117583078661513530238598940099431934653",
                "333449155896468801820679162423656675592"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107819-e75aa4dc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mariadb-corporation/mariadb-connector-c/commit/8153da40fe720b1d25db12aa3f993918da15bd3b",
        "target":  {
            "file":  "unittest/libmariadb/ps.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:51:15Z"