{"id":"RHLW-2026-7e41b237dd570c9f","summary":"Lightwell Security Advisory: mariadb-java-client 3.5.8.rhlw-00003","details":"Red Hat Lightwell has released org.mariadb.jdbc:mariadb-java-client 3.5.8.rhlw-00003 with backported fixes for CVE-2026-55856, CVE-2026-55857, and CVE-2026-55858.\n\nCVE-2026-55856: MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake\n\nCVE-2026-55857: MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials\n\nCVE-2026-55858: MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client\n\nThis patched artifact is a drop-in replacement for org.mariadb.jdbc:mariadb-java-client 3.5.8 from Maven Central.","modified":"2026-10-27T04:00:08.778171283Z","published":"2026-10-08T00:00:00Z","upstream":["CVE-2026-55856","CVE-2026-55857","CVE-2026-55858","GHSA-g9jj-cgmh-9f38","GHSA-qxvw-fvwx-5cp7","GHSA-xvr9-35cr-46v9"],"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55856.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-g9jj-cgmh-9f38"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55856"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/149ec6a626376214966c01f42d48be1b80d06056"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/d90b9872322c76b05a48219be66bff1d33102f8a"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g9jj-cgmh-9f38"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55857.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-qxvw-fvwx-5cp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55857"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qxvw-fvwx-5cp7"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55858.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55858"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xvr9-35cr-46v9"}],"affected":[{"package":{"name":"org.mariadb.jdbc:mariadb-java-client","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.mariadb.jdbc/mariadb-java-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.8.rhlw-00003"}]}],"versions":["1.1.10","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.0-beta-1","1.3.0-beta-2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4.0","1.4.0-beta-1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0-RC1","1.5.1-RC","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","2.0.0-RC","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0-alpha","3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8"],"database_specific":{"lightwell":{"remediated_version":"3.5.8.rhlw-00003","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"3.5.8"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-7e41b237dd570c9f.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}