CVE-2026-55859

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55859
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55859.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55859
Aliases
Published
2026-08-28T22:48:41.592Z
Modified
2026-08-30T08:17:29.750374Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb
Details

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclient through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55859.json",
    "cwe_ids": [
        "CWE-116",
        "CWE-838"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-r2dbc

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-r2dbc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
38bad9afebc6c581a853656a42f9ebf403b1b1b7
Fixed
a82d2658aa0f081e2967521eb45ba91165f7ecd5
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.1"
        }
    ]
}

Affected versions

0.*
0.8.1
0.8.2
1.*
1.0.0
1.1.0-beta
1.2.0
1.2.1
1.2.2
1.3.0
1.4.0

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-55859-0250c75a",
        "target": {
            "file": "src/test/java/org/mariadb/r2dbc/integration/ConnectionTest.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "175449461016011700323899743789300643104",
                "151865224896235913604284388705509472048",
                "49470070527222200272430178483448313444"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-055c20f1",
        "target": {
            "file": "src/main/java/org/mariadb/r2dbc/message/Context.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "311376241794860913811684866166919676769",
                "299254488554560412267049599103447553433"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-267fa781",
        "target": {
            "function": "connectToSocket",
            "file": "src/main/java/org/mariadb/r2dbc/MariadbConnectionFactory.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "97501225860178295876014078662935128876",
            "length": 414.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55859-4d554f75",
        "target": {
            "function": "redirect",
            "file": "src/main/java/org/mariadb/r2dbc/client/SimpleClient.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "96410674812635403064961704368511768443",
            "length": 1795.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55859-5de8563d",
        "target": {
            "function": "handleConnectionError",
            "file": "src/main/java/org/mariadb/r2dbc/client/SimpleClient.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "233672716502376929720775774745702138095",
            "length": 480.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55859-680234b8",
        "target": {
            "file": "src/main/java/org/mariadb/r2dbc/HaMode.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "242356496912250413467939147856499549619",
                "260022072441143881492123846506832677630",
                "159077364659536727243804022826779482619",
                "285092228571018649786998077259903249197",
                "120889995672586767923701201471548033279"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-814f2bad",
        "target": {
            "function": "decode",
            "file": "src/main/java/org/mariadb/r2dbc/message/server/OkPacket.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "299232000241909000197794677479643065559",
            "length": 1790.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55859-9bf3fd59",
        "target": {
            "file": "src/main/java/org/mariadb/r2dbc/client/SimpleContext.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "261264049692410327612566317365309902085",
                "183746314865237572193705111922430388884",
                "46831815411059886601112132982326655164",
                "2565135421973799176815091559569882348",
                "54904543050355290851865391174581538128",
                "337103227735773347348156008315922513185",
                "170408330388696315900131453435357934890",
                "113530839353899358869157931261746764147",
                "191687694071884725146858088820049748223",
                "302541928954372899754424512302847959768"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-a296147b",
        "target": {
            "file": "src/main/java/org/mariadb/r2dbc/MariadbConnectionFactory.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "2567309777181174462833821984951685408",
                "102235928105907349061442073493928328127",
                "242198308907056519414257407240985064468",
                "129215531462866581313638321156385323258"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-addc56f0",
        "target": {
            "file": "src/main/java/org/mariadb/r2dbc/message/server/OkPacket.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "239216688868189889402717598476470579090",
                "299715648229497907326337112855330098198",
                "206602240050124149635417591909172590548",
                "330470515943733910818614974513467453904"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-ca7c3a9a",
        "target": {
            "file": "src/main/java/org/mariadb/r2dbc/client/SimpleClient.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "142853164310802232211719562196573865396",
                "90172037101898019263996909051851658786",
                "289982976341007310322959086637794062194",
                "296672313827438982362408012903850625789",
                "113692644695326238086900003019434915799",
                "205103755823484299502308814795202284741",
                "165978565926233539503364654223995396420",
                "336936947183857340075050047011189396339",
                "24485233734209671093962422492880735978",
                "82268773604908178570554269929883798932",
                "119380717317658996109532803945545149560",
                "323018414072643214565009829936666844406",
                "49424394788822918926237808429175747056"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55859-f8411c2c",
        "target": {
            "function": "connect",
            "file": "src/main/java/org/mariadb/r2dbc/HaMode.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "40256514869054148817868479987780838061",
            "length": 517.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
        "signature_type": "Function"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55859.json"
vanir_signatures_modified 
"2026-08-30T08:17:29Z"