Vulnerability-Lookup

GHSA-5RQC-86VF-G8R2

Vulnerability from github – Published: 2026-08-28 22:49 – Updated: 2026-08-28 22:49

Summary

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

Details

Summary

The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.

Details

The driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. The server can, however, announce a change of character_set_client mid-session through the OK-packet session-state-tracking mechanism, for example via a SET NAMES … run by a stored routine or trigger, by server configuration, or by a hostile server.

If the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.

Am I affected?

You are affected if you use mariadb Connector/R2DBC (org.mariadb:r2dbc-mariadb) below 1.4.1 and a connection can be steered, by a hostile or man-in-the-middle server, or by server-side state such as a stored routine, trigger, or configuration — to switch character_set_client to a non-UTF-8 value mid-session.

Impact

Silent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.

Patches

Fixed in 1.4.1. Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises R2dbcNonTransientResourceException (SQLState 08000) and closes the connection rather than continuing to exchange data under a mismatched encoding. Upgrade to 1.4.1 or later.

Workarounds

There is no reliable application-level workaround; upgrade to 1.4.1 or later.

Credit

Reported by Yalguun Tumenkhuu (@fg0x0).

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mariadb:r2dbc-mariadb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-838"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:49:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.\n\n### Details\n\nThe driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. The server can, however, announce a change of character_set_client mid-session through the OK-packet session-state-tracking mechanism, for example via a SET NAMES \u2026 run by a stored routine or trigger, by server configuration, or by a hostile server.\n\nIf the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.\n\n### Am I affected?\n\nYou are affected if you use mariadb Connector/R2DBC (org.mariadb:r2dbc-mariadb) below 1.4.1 and a connection can be steered, by a hostile or man-in-the-middle server, or by server-side state such as a stored routine, trigger, or configuration \u2014 to switch character_set_client to a non-UTF-8 value mid-session.\n\n### Impact\n\nSilent data corruption and a client/server encoding mismatch once the connection\u0027s charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.\n\n### Patches\n\nFixed in 1.4.1. Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises R2dbcNonTransientResourceException (SQLState 08000) and closes the connection rather than continuing to exchange data under a mismatched encoding. Upgrade to 1.4.1 or later.\n\n### Workarounds\n\nThere is no reliable application-level workaround; upgrade to 1.4.1 or later.\n\n### Credit\n\nReported by Yalguun Tumenkhuu ([@fg0x0](https://github.com/fg0x0/)).",
  "id": "GHSA-5rqc-86vf-g8r2",
  "modified": "2026-08-28T22:49:03Z",
  "published": "2026-08-28T22:49:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1"
    },
    {
      "type": "WEB",
      "url": "https://jira.mariadb.org/browse/R2DBC-124"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output"
}

CVE-2026-55859 (GCVE-0-2026-55859)

Vulnerability from cvelistv5 – Published: 2026-08-28 22:48 – Updated: 2026-08-28 22:48

Title

MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

Summary

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-116 - Improper Encoding or Escaping of Output
CWE-838 - Inappropriate Encoding for Output Context

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_CONFIRM
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://jira.mariadb.org/browse/R2DBC-124	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
mariadb-corporation	mariadb-connector-r2dbc	Affected: < 1.4.1
org.mariadb	r2dbc-mariadb	Affected: < 1.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mariadb-connector-r2dbc",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        },
        {
          "product": "r2dbc-mariadb",
          "vendor": "org.mariadb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-838",
              "description": "CWE-838: Inappropriate Encoding for Output Context",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:48:41.592Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1"
        },
        {
          "name": "https://jira.mariadb.org/browse/R2DBC-124",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/R2DBC-124"
        }
      ],
      "source": {
        "advisory": "GHSA-5rqc-86vf-g8r2",
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55859",
    "datePublished": "2026-08-28T22:48:41.592Z",
    "dateReserved": "2026-06-17T16:44:40.995Z",
    "dateUpdated": "2026-08-28T22:48:41.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-5RQC-86VF-G8R2

Summary

Details

Am I affected?

Impact

Patches

Workarounds

Credit

CVE-2026-55859 (GCVE-0-2026-55859)

Tags

Sightings

Nomenclature