Character Set Mismatch in MariaDB Connector/R2DBC Affects Data Integrity

CVE-2026-55859

What is CVE-2026-55859?

MariaDB Connector/R2DBC, a Java client for MariaDB and MySQL, suffers from a character encoding issue prior to version 1.4.1. The underlying problem arises when the connection character set is assumed to be UTF-8, leading to silent data corruption. A server can change the character set during a session, which may not align with the driver's UTF-8 assumption. This mismatch can cause confusion between client and server, potentially allowing unsanitized data to be processed incorrectly. The fix in version 1.4.1 restricts character sets to only utf8, utf8mb3, or utf8mb4, ensuring connections are securely maintained and preventing data integrity issues.

References