Data Corruption Vulnerability in MariaDB Connector/J for Java Applications

CVE-2026-55858

What is CVE-2026-55858?

The MariaDB Connector/J, an interface for connecting Java applications to MariaDB and MySQL databases, previously operated under the assumption that connections used the UTF-8 character set. This vulnerability arises when a change in the character_set_client occurs mid-session, potentially triggered by various factors such as server configuration, stored routines, or external triggers. If the character set switches to a non-UTF-8 value while the driver continues to treat the data as UTF-8, it can lead to a mismatch and result in silent data corruption. To mitigate this issue, the latest versions enforce strict adherence to accepted UTF-8 character sets, thus closing the affected connections upon detecting any other character set.

References