CVE-2026-55859

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.

• CWE-116
• CWE-838

• https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7
• https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
• https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2
• https://jira.mariadb.org/browse/R2DBC-124

Published

Aug 28, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55852Frappe is a full-stack web application framework. Prior to 1…8.6
• CVE-2026-55854MariaDB Connector/Node.js is used to connect applications de…5.9
• CVE-2026-55855MariaDB Connector/Node.js is used to connect applications de…6.5
• CVE-2026-55856MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55857MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55858MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-5586A vulnerability was determined in zhongyu09 openchatbi up to…6.3
• CVE-2026-55860MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-55863motionEye (mEye) is an online interface for a piece of softw…5.3
• CVE-2026-55864GeoNetwork is a catalog application to manage spatially refe…7.8
• CVE-2026-55865Python Liquid is a Python engine for the Liquid template lan…7.1
• CVE-2026-55866SpiceDB is an open source database system for creating and m…3.7