5.9
Medium
CVE-2026-107819 MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases
Description
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| server 3.4 | 3.4.1 → < 3.4.10 | 3.4.10 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- jira.mariadb.org jira.mariadb.org
Timeline
- Published
- Last modified
Other CVEs of server
The 27 CVEs of server →
CVE-2026-102523
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
8.0
High
CVE-2026-86047
MariaDB server is a community developed fork of MySQL server
7.7
High
CVE-2026-85745
MariaDB server is a community developed fork of MySQL server
4.3
Medium
CVE-2026-85748
MariaDB server is a community developed fork of MySQL server
9.9
Critical