NES for MariaDB Connector/R2DBC 1.1.x Release Notes

Security Fixes

• AuthenticationFlow no longer sends the password in clear text when the server selects the mysql_clear_password (ClearPasswordPluginFlow) or PAM dialog (PamPluginFlow) authentication plugin, in the initial handshake or through an authentication switch, over a connection that is neither TLS nor a local unix socket; such logins now fail with an R2dbcPermissionDeniedException (Authentication plugin '<plugin>' is a clear-text password plugin that cannot be used over an insecure connection) unless sslMode enables TLS or a unix socket is used (CVE-2026-55860).
• SimpleContext no longer lets a connection keep exchanging data after the session character_set_client is changed to a non-UTF-8 charset, and instead closes the connection with an R2dbcNonTransientResourceException (SQLState 08000). OkPacket now reads every entry of a session-state block instead of only the first one, so a charset change bundled with other session changes is caught too, and the driver now forces SET NAMES utf8mb4 at connect and sets its own session_track_system_variables list so a server or proxy cannot hide charset changes from it (CVE-2026-55859).