RHLW-2026-7e41b237dd570c9f

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-7e41b237dd570c9f.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-7e41b237dd570c9f.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-7e41b237dd570c9f
Upstream
CVE (3)
GHSA (3)
Published
2026-10-08T00:00:00Z
Modified
2026-10-27T04:00:08Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Lightwell Security Advisory: mariadb-java-client 3.5.8.rhlw-00003
Details

Red Hat Lightwell has released org.mariadb.jdbc:mariadb-java-client 3.5.8.rhlw-00003 with backported fixes for CVE-2026-55856, CVE-2026-55857, and CVE-2026-55858.

CVE-2026-55856: MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

CVE-2026-55857: MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

CVE-2026-55858: MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client

This patched artifact is a drop-in replacement for org.mariadb.jdbc:mariadb-java-client 3.5.8 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.mariadb.jdbc:mariadb-java-client

Package

Name
org.mariadb.jdbc:mariadb-java-client
Purl
pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.8.rhlw-00003

Affected versions

1.*
1.1.7
1.1.8
1.1.9
1.1.10
1.2.0
1.2.1
1.2.2
1.2.3
1.3.0-beta-1
1.3.0-beta-2
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0-beta-1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.5.0-RC1
1.5.1-RC
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.8.0
2.*
2.0.0-RC
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.7.13
2.7.14
2.7.15
3.*
3.0.0-alpha
3.0.1-beta
3.0.2-rc
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8

Database specific

lightwell 
{
    "backport_base_version":  "3.5.8",
    "remediated_version":  "3.5.8.rhlw-00003",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-7e41b237dd570c9f.json"