Executive brief
The MariaDB Java database driver assumes all character data is encoded in UTF-8, but fails to validate when a database server changes the character set mid-connection to a non-UTF-8 encoding. This causes silent data corruption where the driver and server interpret the same bytes differently, and can lead to SQL injection attacks by bypassing the driver's quoting and escaping mechanisms.
Technical details
The vulnerability is a character encoding mismatch (CWE-838) in the MariaDB Java JDBC driver. The driver hardcodes the assumption that all character data is UTF-8 encoded and does not dynamically track or validate charset changes. An attacker who can influence the database connection (e.g., via a compromised server or man-in-the-middle position) can issue SET NAMES or similar commands to change character_set_client to a non-UTF-8 charset. After this change, the driver continues to encode/decode data as UTF-8 while the server interprets the bytes as a different encoding, leading to silent data corruption. More critically, this charset confusion undermines the byte-wise semantics of the driver's parameterized query escaping, potentially allowing SQL injection. Patches were released for versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9; the fix rejects any post-initialization charset change to non-UTF-8 values and closes the connection with a SQLException.
Affected products
- MariaDB mariadb-java-client < 2.7.14, >= 3.0.0 and < 3.3.5, >= 3.4.0 and < 3.4.3, >= 3.5.0 and < 3.5.9
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9