{"vulnerability": "cve-2026-55859", "sightings": [{"uuid": "2c36c85c-c108-407a-9427-0fb59c9ec7a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55859", "type": "seen", "source": "https://gist.github.com/alon710/dd09c3ef696a75a72346fac91d4e54bd", "content": "# CVE-2026-55859: CVE-2026-55859: Client-Server Charset Confusion in MariaDB Connector/R2DBC leading to SQL Injection\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55859\n\n## Summary\nAn input validation and encoding desynchronization vulnerability exists in MariaDB Connector/R2DBC versions prior to 1.4.1. The driver assumes all communication utilizes the UTF-8 character set, but fails to account for server-driven mid-session changes to the character_set_client variable. When a change to a multi-byte character set such as GBK or Big5 is induced, the server interprets client-escaped single quotes as part of a multi-byte character. This state desynchronization bypasses standard escaping mechanisms and allows remote unauthenticated attackers to execute arbitrary SQL commands.\n\n## TL;DR\nA charset desynchronization vulnerability in MariaDB Connector/R2DBC allows attackers to bypass SQL character escaping and execute arbitrary database queries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116, CWE-838\n- **Attack Vector**: Network\n- **Complexity**: High\n- **CVSS Score**: 5.9\n- **Impact**: Integrity (SQL Injection)\n- **Exploit Status**: Conceptual / PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- MariaDB Connector/R2DBC\n- **MariaDB Connector/R2DBC**: < 1.4.1 (Fixed in: `1.4.1`)\n\n## Mitigation\n\n- Upgrade MariaDB Connector/R2DBC to version 1.4.1 or higher.\n- Enforce TLS (sslMode=VERIFY_CA/VERIFY_FULL) to prevent MITM charset-tracking packet modification.\n- Restrict execution of stored procedures and triggers that modify server variables dynamically.\n\n**Remediation Steps:**\n1. Identify any Maven or Gradle dependency references to org.mariadb:r2dbc-mariadb.\n2. Update dependency version declaration to 1.4.1 or higher.\n3. Deploy application with upgraded libraries.\n4. Configure database connection pools to enforce TLS verification to counter MITM vectors.\n\n## References\n\n- [GitHub Security Advisory GHSA-5rqc-86vf-g8r2](https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2)\n- [MariaDB JIRA Bug Ticket R2DBC-124](https://jira.mariadb.org/browse/R2DBC-124)\n- [Official Release Announcement 1.4.1](https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55859) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T02:32:11.153666Z"}]}