MariaDB Corporation MariaDB Connector/R2DBC up to 1.4.0 Encoding encoding error

Summaryinfo

A vulnerability was found in MariaDB Corporation MariaDB Connector and R2DBC up to 1.4.0. It has been rated as problematic. This impacts an unknown function of the component Encoding. The manipulation leads to encoding error. This vulnerability is uniquely identified as CVE-2026-55859. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in MariaDB Corporation MariaDB Connector and R2DBC up to 1.4.0 and classified as problematic. This issue affects an unknown function of the component Encoding. The manipulation with an unknown input leads to a encoding error vulnerability. Using CWE to declare the problem leads to CWE-172. The product does not properly encode or decode the data, resulting in unexpected values. Impacted is integrity. The summary by CVE is:

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-55859 since 06/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.4.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MariaDB Corporation

Name

• MariaDB Connector
• R2DBC

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion