CVE-2026-55856Medium· 5.9▾ SunlitMariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a pa…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.mariadb.jdbc:mariadb-java-client < 2.7.14org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.5org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.3org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.9Patched in:
org.mariadb.jdbc:mariadb-java-client 2.7.14org.mariadb.jdbc:mariadb-java-client 3.3.5org.mariadb.jdbc:mariadb-java-client 3.4.3org.mariadb.jdbc:mariadb-java-client 3.5.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55857Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
CVE-2026-55858Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
CVE-2026-55215High· 7.5MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
CVE-2026-55860Medium· 5.9MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java
CVE-2026-55854Medium· 5.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
CVE-2020-5404Medium· 5.9The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain