Update dependency org.mariadb.jdbc:mariadb-java-client to v3.5.9 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.mariadb.jdbc:mariadb-java-client (source)	3.5.1 → 3.5.9

---

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

CVE-2026-55856 / GHSA-g9jj-cgmh-9f38

More information

Details

Summary

When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a server certificate, Connector/J deliberately accepts an untrusted/self-signed certificate at the TLS layer (the "MITM-proof without a CA" feature) and proves the server's identity afterwards by binding the certificate fingerprint into the authentication exchange. That fingerprint enforcement is applied to the OK-packet and auth-switch paths but not to the initial-handshake path. An active man-in-the-middle that presents a self-signed certificate, claims to be MariaDB, and names the initial authentication plugin mysql_clear_password receives the victim's database password in cleartext, before any fingerprint/identity check runs. The connection is torn down a moment later, but the credential is already gone.

Details

For sslMode=verify-full/verify-ca with a password and no serverSslCert/trustStore, the connector falls back to an ephemeral trust manager (default fallbackToSystemTrustStore=true) that accepts any non-expired certificate at the TLS layer and records its fingerprint. Identity is then meant to be enforced via that fingerprint.

The enforcement guard is present on two of the three paths, the OK-packet fingerprint check and the auth-switch handler (where the clear-password plugin is only allowed when the fingerprint is already verified). It is absent on the initial-handshake send: HandshakeResponse.encode() builds the mysql_clear_password response after checking only that SSL is enabled, never consulting the recorded fingerprint, sslMode, or whether the plugin is MITM-proof. By that point the connector already knows the certificate was self-signed. The clear-password plugin does not declare itself MITM-proof (it inherits the safe default), which confirms it is meant to be refused on an unverified certificate; the initial-handshake path simply never consults that flag. The initial path also bypasses restrictedAuth.

Impact

An active man-in-the-middle steals the full cleartext database password of any Java application using Connector/J with sslMode=verify-full/verify-ca plus a password and no pinned certificate, the configuration documented as the easy, secure default. With the captured credentials the attacker can take over the database account and read or modify all data that account is authorized for. The victim takes no unusual action; the developer explicitly enabled TLS verification expecting exactly this protection.

Patches

Fixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). The fix applies the same certFingerprint != null && !isMitMProof() guard to the initial-handshake path before writing the auth response, refusing to send a mysql_clear_password (or any non-MITM-proof) response on an as-yet-unverified certificate, matching the auth-switch path.

Workarounds

If you cannot upgrade immediately, pin the server certificate (serverSslCert= the real CA / server cert). With a pinned certificate the self-signed certificate of a man-in-the-middle is rejected at the TLS layer before any password is transmitted.

Credit

Reported by haaahaaahiihiiii

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-g9jj-cgmh-9f38
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/149ec6a626376214966c01f42d48be1b80d06056
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/d90b9872322c76b05a48219be66bff1d33102f8a
• https://hackerone.com/reports/3777370
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9
• https://jira.mariadb.org/browse/CONJ-1325
• https://github.com/advisories/GHSA-g9jj-cgmh-9f38

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

CVE-2026-55857 / GHSA-qxvw-fvwx-5cp7

More information

Details

### Summary

When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password.

Details

The mysql_clear_password plugin is gated behind a secure connection: the driver refuses to transmit the password in cleartext over plain TCP. The sibling PAM plugin handler (SendPamAuthPacketFactory, server-side plugin name dialog) did not override that gate and inherited the default value false, so it was not subject to the same secure-transport requirement.

As a result, a hostile or man-in-the-middle server can issue an Authentication Switch Request for the dialog plugin over plain TCP, and the driver responds with the user's password in cleartext. With the default configuration (sslMode=DISABLE, restrictedAuth=null) this is reachable with no non-default options.

Am I affected?

You are affected if all of the following hold:

• You use mariadb Connector/J at a version below the patched release(s).
• Connections can occur over an insecure transport — i.e. plain TCP (sslMode=DISABLE), or a TLS mode that establishes server identity only via self-signed-certificate fingerprint validation.
• An attacker can occupy an on-path (MITM) position, or otherwise cause the client to connect to a server they control, and present an Authentication Switch Request for the dialog plugin.

Connections over properly verified TLS or a local Unix socket are not exposed to this vector.

Impact

Disclosure of the authenticating account's password in cleartext to an on-path or hostile server. The captured credentials can then be reused to authenticate to the database.

Patches

Fixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). PAM (dialog) is now treated exactly like mysql_clear_password: it may only run over a secure transport. SendPamAuthPacketFactory overrides the secure-required flag to true, and the authentication dispatcher permits a secure-required plugin only when the connection is TLS or a local Unix socket. The pre-existing check that blocks non-MITM-proof plugins when server identity relies solely on self-signed-certificate fingerprint validation continues to apply. Net effect: PAM is allowed over TLS or a Unix socket, and rejected over plain TCP or fingerprint-only connections.

Workarounds

If you cannot upgrade immediately:

• Connect over verified TLS (set sslMode=verify-full) so a man-in-the-middle cannot impersonate the server, or use a local Unix socket.
• Restrict the permitted authentication plugins via restrictedAuth so dialog cannot be negotiated over an insecure transport.

Credit

Reported by Yalguun Tumenkhuu (@​fg0x0).

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-qxvw-fvwx-5cp7
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9
• https://jira.mariadb.org/browse/CONJ-1320
• https://github.com/advisories/GHSA-qxvw-fvwx-5cp7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

CVE-2026-55858 / GHSA-xvr9-35cr-46v9

More information

Details

Summary

The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.

Details

The driver encodes and decodes all character data on the assumption that the connection character set is UTF-8.
Charset can be changed by commands like SET NAMES... commands.

If the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.

Impact

Silent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.

Patches

Fixed in 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Upgrade to the patched release on your branch (3.5.x → 3.5.9, 3.4.x → 3.4.3, 3.0/3.1/3.2/3.3.x → 3.3.5, 2.x → 2.7.14). Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises a SQLException with SQLState 08000 (connection exception) and closes the connection rather than continuing to exchange data under a mismatched encoding.

Workarounds

There is no reliable application-level workaround.

Credit

Reported by Yalguun Tumenkhuu (@​fg0x0).

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9
• https://jira.mariadb.org/browse/CONJ-1317
• https://github.com/advisories/GHSA-xvr9-35cr-46v9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v3.5.9

Compare Source

Full Changelog

Key Enhancements

• CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
• CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
• CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
• CONJ-1310 - Add full native image support and CI coverage

Issues Resolved

• CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
• CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
• CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled
• CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
• CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info_schema fallback
• CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches
• CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE
• CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY_FULL when client socket IP is set
• CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value
• CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes
  locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

v3.5.8

Compare Source

Full Changelog

Issues Resolved

• CONJ-1305 - XAResource.isSameRM() incorrectly returns true when rewriteBatchedStatements differs between connections
• CONJ-1303 - Statement.cancel() fails to kill running query during result streaming

Other

• CONJ-1298 - Performance improvement: avoid decoding extended format

v3.5.7

Compare Source

Full Changelog

Key Enhancements

• CONJ-1282 - Added TLS SNI (Server Name Indication) support
• CONJ-1271 - Added MariaDbDataTruncation exception that includes MariaDB error code and error message

Issues Resolved

• CONJ-1291 - Fixed ConnectionPoolDataSource incompatibility and connection leaks due to internal ConnectionEventListener in MariaDB Connector/J 3.5.x
• CONJ-1286 - Fixed MariaDbPoolPinnedConnection thread-safety issue
• CONJ-1283 - Fixed rewriteBatchedStatements introduced in 3.5.6 bug when having parentesis after VALUES parts
• CONJ-1287 - Fixed authentication plugin multi-exchange prefix (0x01) handling introduced in MDEV-37554
• CONJ-1290 - Fixed NullPointerException in MultiPrimaryReplicaClient
• CONJ-1295 - Fixed MariaDbClob compilation with JDK 26+

v3.5.6

Compare Source

Full Changelog

Key Enhancements

• CONJ-1238 - rewriteBatchStatements implementation
• CONJ-1274 - server prepared statement client failover to client prepared statement

Issues Resolved

• CONJ-1278 - prepared statement caching enablement correction, same than 2.x
• CONJ-1279 - metadata table name addition for 12.1 after MDEV-28933
• CONJ-1280 - permit having multiple command with initSql option
• CONJ-1276 - Connection#isValid(int timeout) does not obey the passed in timeout if the network is down.

v3.5.5

Compare Source

Full Changelog

Issues Resolved

• CONJ-1265 - ensure rollback and release savepoint operation to be sent to server, even when there is no transaction in progress
• CONJ-1270 - forceConnectionTimeZoneToSession doesn't always set the timezone to server

v3.5.4

Compare Source

Full Changelog

Key Enhancements

• CONJ-1261 - Added caching option for loadCodecs results to improve performance

Issues Resolved

• CONJ-1234 - Fixed incorrect type definitions in DatabaseMetaData.getTypeInfo()
• CONJ-1247 - Resolved potential race condition that could cause NullPointerException
• CONJ-1250 - avoids redundant queries for CallableStatement.getParameterMetaData()
• CONJ-1251 - Fixed SSL configuration issue where zero SSL settings only functioned without explicit SSL configuration
• CONJ-1252 - Resolved GSSAPI authentication error when server exchanges begin with 0x01 byte
• CONJ-1254 - Corrected DatabaseMetadata.getTypeInfo() returning incorrect values for AUTO_INCREMENT, FIXED_PREC_SCALE, and CASE_SENSITIVE fields
• CONJ-1255 - Fixed getString method on BIT(1) fields to properly honor transformedBitIsBoolean configuration
• CONJ-1259 - Enhanced metadata compatibility with MariaDB version 12.0
• CONJ-1260 - Improved performance of DatabaseMetaData.getExportedKeys method
• CONJ-1256 - Fixed issue to ensure correct catalog name is returned

v3.5.3

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1226 Fixed issue where dates containing zero day or month resulted in a DateTimeException
• CONJ-1232 Resolved timestamp string representation incompatibility between versions 2.7 and 3.x
  • see new option oldModeNoPrecisionTimestamp
• CONJ-1226 Fixed incorrect values returned by ResultSet.getColumnType() for unsigned values
• CONJ-1241 Corrected regression in 3.x affecting column metadata for unsigned types
• CONJ-1243 Fixed CallableStatement.getParameterMetadata() returning wrong java.sql.Type for boolean values
• CONJ-1236 Prevented NPE (Null Pointer Exception) after reconnection failure in high availability configurations
• CONJ-1237 Fixed issue with incorrect statements.isClosed value after closing connection
• CONJ-1239 Disabled BULK operations when no parameters are present
• CONJ-1240 Fixed connectivity issues with databases that only accept TLSv1.3
• CONJ-1235 Modified redirection option to enable by default only when SSL is enabled

v3.5.2

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1216 Resolved a performance issue that occurred when batch processing on MySQL and older MariaDB (pre-10.2) servers
• CONJ-1218 Incorrect behavior where XA connections are closed when regular connections are terminated - this is against specifications
• CONJ-1217 The trustCertificateKeyStorePassword alias parameter isn’t taken into account
• CONJ-1221 DatabaseMetadata.getTypeInfo() is missing the data types UUID and VECTOR
• CONJ-1225 System throws an exception prematurely without checking all available connections
• CONJ-1228 result-set.getObject() on BLOB type returns Blob in place of byte[]
• CONJ-660 new disconnectOnExpiredPasswords connection option that controls client behavior when connecting with an expired password.
  When set to true (default), the client disconnects if it detects an expired password.
  When false, the client maintains the connection and allows setting a new password.
• CONJ-1229 Permit executeQuery commands to not return a result-set

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud