Medium [CVE-2026-55858] Silent data corruption due to character set mismatch
This medium-severity Red Hat Linux advisory covers CVE-2026-55858 affecting OpenShift Pipelines, Red Hat build of Debezium 3, Red Hat Build of Keycloak.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8.
The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server.
If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping.
The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
The connector incorrectly assumes a UTF-8 character set for communication, even if the database server changes its client character set to a non-UTF-8 value during a session.
This mismatch can lead to silent data corruption, where data is written and read incorrectly, and may also allow attackers to bypass security mechanisms like byte-wise quoting or escaping.
- < 2.7.14
- < 3.3.5
- < 3.4.3
- < 3.5.9
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 2.7.14
- 3.3.5
- 3.4.3
- 3.5.9
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Upgrade MariaDB Connector/J to a fixed version (2.7.14, 3.3.5, 3.4.3, or 3.5.9, as appropriate for the branch in use), which rejects any post-initialization character set other than utf8, utf8mb3, or utf8mb4 and closes the connection. Where upgrading is not immediately possible, avoid changing character_set_client after connection establishment and connect only to trusted database servers.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.