NES for MariaDB Connector/J 3.1.x Release Notes

Security Fixes

• The PAM dialog authentication plugin (SendPamAuthPacket) and mysql_clear_password (ClearPasswordPlugin) no longer send the password in clear text when a server requests them through an authentication switch over a connection that is neither TLS nor a local unix socket; such logins, including PAM over plain TCP or a Windows named pipe, now fail with Cannot use authentication plugin <plugin> if SSL is not enabled (SQLState 08000) unless TLS or localSocket is used (CVE-2026-55857).
• BaseContext no longer lets a connection keep exchanging data after the session character_set_client is changed to a non-UTF-8 charset, and instead closes the connection with a SQLNonTransientConnectionException (CVE-2026-55858).
• BaseContext no longer lets a connection keep decoding results after the session character_set_results is changed to a non-UTF-8 charset, and the driver now sets its own session_track_system_variables list so a server or proxy cannot hide charset changes from it (GHSA-grfq-r75j-rw9x).
• ClientMessage.readPacket no longer sends a local file to the server when allowLocalInfile is disabled, and instead refuses the server's LOCAL INFILE request with an SQLException (CVE-2026-61700).
• The XA recover() of MariaDbPoolConnection no longer sizes or splits Xids from unvalidated server-supplied gtrid_length and bqual_length values from XA RECOVER: a row with a negative length, a length over 64 bytes, or lengths that exceed its data now fails the whole recovery scan with XAException(XAER_RMFAIL) instead of an unchecked exception or a very large allocation (GHSA-4jq2-8v3c-97w8).
• TextRowDecoder and BinaryRowDecoder no longer read a requested row field whose server-declared length is larger than the bytes left in the row packet, and raise a SQLException instead; ColumnDecoder rejects extended column metadata that overruns its sub-packet, and OkPacket rejects a session-state block longer than the packet, both with an IllegalArgumentException, while a session-state variable or schema entry that overruns its block is ignored (GHSA-wfxr-v78w-p49r).
• StandardReadableByteBuf.readLength and readIntLengthEncodedNotNull no longer narrow a server-sent 8-byte length-encoded integer to a negative or wrapped int and reject it with an IllegalArgumentException, and a requested text or binary row field with such a length fails with a SQLException instead of returning NULL or a wrong value (GHSA-797x-p4mc-jwpm).
• StandardReadableByteBuf.readLengthBuffer no longer accepts a server-declared length that is negative or larger than the bytes left in the packet, and OkPacket no longer skips an info length past the end of the packet, so a server-declared length can no longer force a large heap allocation (GHSA-h599-m3w5-9m7x).
• CachingSha2PasswordPlugin now reads the caching_sha2_password fast-authentication result as a single status byte instead of sizing an allocation from a server-declared length, so a rogue or man-in-the-middle server can no longer crash the client with an OutOfMemoryError or NegativeArraySizeException through that packet; a malformed result now fails the connection with a SQLException (GHSA-r9vh-xh4r-j6gr). The driver now also accepts a fast-authentication result or RSA public-key packet sent without the 0x01 prefix, and rejects a fast-authentication result that carries extra bytes after its status byte.

Notes

• NES for MariaDB Connector/J 3.1.x is not affected by CVE-2026-55856 or GHSA-fhx5-2xqw-2cgm: the 3.1.x line does not contain the vulnerable code.