Executive brief
The MariaDB R2DBC connector is a database driver used by Java applications to connect to MariaDB databases. Due to a character encoding flaw, an attacker or malicious server can force a mid-session encoding switch that causes the driver and server to interpret data differently. This mismatch undermines SQL escaping mechanisms and can lead to SQL injection attacks, data corruption, and potential unauthorized database access.
Technical details
The vulnerability is a charset-confusion flaw in the org.mariadb:r2dbc-mariadb library (versions before 1.4.1). The driver hardcodes UTF-8 encoding for all character data but does not validate or enforce that the server's character_set_client remains UTF-8 after initial connection. An attacker or man-in-the-middle server can exploit the MySQL/MariaDB OK-packet session-state-tracking mechanism to announce a character_set_client change mid-session (e.g., via SET NAMES, stored routines, triggers, or server configuration). Once the encoding diverges, the driver continues reading and writing UTF-8 while the server interprets the same bytes using a different encoding, breaking the assumption that quoting and escaping operate on UTF-8 boundaries. This permits charset-confusion attacks that bypass SQL injection protections. Fixed in version 1.4.1, which rejects any charset change to non-UTF-8 variants (utf8, utf8mb3, utf8mb4) after connection initialization by raising R2dbcNonTransientResourceException and closing the connection.
Affected products
- MariaDB R2DBC Connector < 1.4.1
Timeline
- 2026-07-09: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-07-09: patched: Fixed in version 1.4.1
- 2026-08-28: advisory: GitHub Advisory GHSA-5rqc-86vf-g8r2 updated and reviewed