CVE-2026-55856
1 advisory.
Maven/org.mariadb.jdbc:mariadb-java-client CVE-2026-55856: medium 5.9, EPSS 0.44%
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
Action: Upgrade org.mariadb.jdbc:mariadb-java-client to 2.7.14 (2.7.x), 3.3.5 (3.3.x), 3.4.3 (3.4.x) or 3.5.9 (3.5.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.14 | - |
| 3.0.0 | 3.3.5 | - |
| 3.4.0 | 3.4.3 | - |
| 3.5.0 | 3.5.9 | - |
Fixed versions
| 2.7.14 | 3.3.5 | 3.4.3 | 3.5.9 |
Sources
- osv: GHSA-g9jj-cgmh-9f38
- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-g9jj-cgmh-9f38
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/149ec6a626376214966c01f42d48be1b80d06056
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/d90b9872322c76b05a48219be66bff1d33102f8a
- https://hackerone.com/reports/3777370
- https://github.com/mariadb-corporation/mariadb-connector-j
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9
- https://jira.mariadb.org/browse/CONJ-1325
CVE-2026-55856 · published · modified · JSON