MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
CVE-2026-55858
This medium-severity CVE scores 5.9 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- Lower severity and no public exploit yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 5.9
- EG Score
- 5.9(low)
- EG Risk
- 31(Track)EG Risk 31/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity59% × 45%Exploitation0% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 27%
- KEV
- Not listed
Published
August 28, 2026
Last Modified
August 28, 2026
Advisory Details (10)
Auto-updated Aug 28, 2026[CONJ-1317] Reject runtime switch of the connection character set to a non-UTF-8 charset - Jira
https://jira.mariadb.org/browse/CONJ-1317MariaDB Connector/Java 3.5.9
Patch available: mariadb-corporation/mariadb-connector-j 3.5.9
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9MariaDB Connector/Java 3.4.3
Patch available: mariadb-corporation/mariadb-connector-j 3.4.3
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3MariaDB Connector/Java 3.3.5
Patch available: mariadb-corporation/mariadb-connector-j 3.3.5
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5MariaDB Connector/Java 2.7.14
Patch available: mariadb-corporation/mariadb-connector-j 2.7.14
https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14commit c555c9b47752 (mariadb-corporation/mariadb-connector-j)
Patch available: mariadb-corporation/mariadb-connector-j 3.4.3 (contains commit c555c9b47752)
https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607commit 8cfd9df69737 (mariadb-corporation/mariadb-connector-j)
Patch available: mariadb-corporation/mariadb-connector-j 3.3.5 (contains commit 8cfd9df69737)
https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6commit 7b3c69221b54 (mariadb-corporation/mariadb-connector-j)
Patch available: mariadb-corporation/mariadb-connector-j 3.5.9 (contains commit 7b3c69221b54)
https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7commit 300716bef1e1 (mariadb-corporation/mariadb-connector-j)
Patch available: mariadb-corporation/mariadb-connector-j 2.7.14 (contains commit 300716bef1e1)
https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client · Advisory · mariadb-corporation/mariadb-connector-j · GitHub
Affected: 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3
https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9Vendor Advisories for CVE-2026-55858(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 4× in last 7d / 4× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-08-30 01:22 UTCEPSS rescore
- 2026-08-28 23:24 UTCEG score recompute
- 2026-08-28 22:48 UTCEG score recompute
- 2026-08-28 22:48 UTCMITRE cvelistV5first tracked
Frequently asked(5)
What is CVE-2026-55858?
When was CVE-2026-55858 disclosed?
Is CVE-2026-55858 actively exploited?
What is the CVSS score of CVE-2026-55858?
How do I remediate CVE-2026-55858?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-55858
Is Your Infrastructure Affected by CVE-2026-55858?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.