NES for MySQL Connector/J 8.0.x Release Notes

Security Fixes

• X DevAPI SyncMessageReader and CompressionSplittedInputStream no longer allocate buffers from a server-supplied frame length that is zero, exceeds the signed 32-bit range, or is larger than mysqlx_max_allowed_packet; such frames raise CJCommunicationsException or CJPacketTooBigException instead (CVE-2026-60624).
• AuthenticationKerberosClient and the GSSAPI mechanism of AuthenticationLdapSaslClientPlugin no longer run any JAAS login module other than com.sun.security.auth.module.Krb5LoginModule from the MySQLConnectorJ login configuration entry (CVE-2025-30706).
• Extension class names supplied through connection properties, such as socketFactory, authentication plugins, loadBalanceSQLExceptionSubclassFailover and X Protocol compression stream classes, are rejected by Util.loadClass unless they are valid Java binary class names, so URL and jar locator strings no longer reach the class loader (CVE-2026-101768).
• NativeProtocol no longer opens a LOAD DATA LOCAL INFILE URL whose protocol is not file or whose host is not a loopback address, and it applies the allowLoadLocalInfileInPath restriction whenever it is set, including when allowLoadLocalInfile=true and allowUrlInLocalInfile=true (CVE-2026-61082).
• ExportControlled no longer loads a client certificate key store or trust store from anything other than a local file path or a local file: URL (CVE-2026-60623).
• NativeProtocol no longer accepts UNC or other network path forms in LOAD DATA LOCAL INFILE file: URLs (CVE-2026-60586).
• TextResultsetReader and BinaryResultsetReader no longer accept a server-reported result set column count below 1 or above 65535, or a truncated OK packet, and fail the read with a communications error instead (CVE-2026-101678).

Notes

• This release originates from the open-source MySQL Connector/J project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.

Security Fixes

• Removed the exploitable autoDeserialize feature (CVE-2023-22102).