CVE-2026-55859: CWE-116: Improper Encoding or Escaping of Output in mariadb-corporation mariadb-connector-r2dbc

MariaDB Connector/R2DBC, a Java non-blocking client for MariaDB and MySQL, assumed UTF-8 encoding for all character data prior to version 1.4.1. However, a server can change the character_set_client mid-session via session-state-tracking mechanisms such as SET NAMES in stored routines or triggers. If the new character set is not UTF-8, the driver continues to encode/decode as UTF-8 while the server interprets bytes differently, causing silent data corruption and charset confusion. This mismatch can defeat byte-wise quoting or escaping, leading to improper encoding or escaping of output (CWE-116). The fix in version 1.4.1 enforces acceptance of only utf8, utf8mb3, or utf8mb4 character sets after initialization, raising an exception and closing the connection if others are encountered.

The vulnerability can cause silent data corruption due to mismatched character encoding between client and server. This charset confusion can defeat byte-wise quoting or escaping mechanisms, potentially leading to injection or data integrity issues. There is no direct confidentiality or availability impact reported. Exploitation requires a server to change the character_set_client mid-session to a non-UTF-8 encoding, which may be possible via stored routines, triggers, server configuration, or a hostile/man-in-the-middle server.

Upgrade to MariaDB Connector/R2DBC version 1.4.1 or later, which enforces acceptance of only utf8, utf8mb3, or utf8mb4 character sets after initialization and closes connections if others are encountered. No other mitigations are indicated. Patch status is not explicitly stated but the fix is included in version 1.4.1.