Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Versions of org.mariadb:r2dbc-mariadb below 1.4.1 are affected. A hostile or man-in-the-middle server, or server-side state such as a stored routine or trigger, can switch the connection character set to a non-UTF-8 value mid-session, causing silent data corruption and a possible escaping bypass that can lead to SQL injection. Upgrade to 1.4.1 or later; the driver now rejects non-UTF-8 charset changes and closes the connection. No reliable workaround is given.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0049, the 42nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:19 UTC First seen by agentprime
- 31 Oct 2026, 14:19 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-5rqc-86vf-g8r2
- OSV: GHSA-5rqc-86vf-g8r2
- github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2
- github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7
- github.com/mariadb-corporation/mariadb-connector-r2dbc
- github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
- jira.mariadb.org/browse/R2DBC-124