GHSA-xvr9-35cr-46v9

The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.

Details

The driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. Charset can be changed by commands like SET NAMES... commands.

If the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.

Impact

Silent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.

Patches

Fixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises a SQLException with SQLState 08000 (connection exception) and closes the connection rather than continuing to exchange data under a mismatched encoding.

Workarounds

There is no reliable application-level workaround.

Credit

Reported by Yalguun Tumenkhuu (@fg0x0).

Database specific

{
    "cwe_ids":  [
        "CWE-838"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-28T22:47:19Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.14

Affected versions

1.*

1.1.7

1.1.8

1.1.9

1.1.10

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0-beta-1

1.3.0-beta-2

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0-beta-1

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.5.0-RC1

1.5.1-RC

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.8.0

2.*

2.0.0-RC

2.0.1

2.0.2

2.0.3

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.6.0

2.6.1

2.6.2

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.7.8

2.7.9

2.7.10

2.7.11

2.7.12

2.7.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.3.5

Affected versions

3.*

3.0.1-beta

3.0.2-rc

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.2.0

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.4.0

Fixed

3.4.3

Affected versions

3.*

3.4.0

3.4.1

3.4.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.5.0

Fixed

3.5.9

Affected versions

3.*

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.5.7

3.5.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xvr9-35cr-46v9/GHSA-xvr9-35cr-46v9.json"