p PatchFirst

CVE-2026-107819

CVE-2026-107819 · MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

CVSS 5.9 · Medium · EPSS 0.3%

Published
Updated

Stack: system · database

Affected products and versions

  • server

    Versions
    • >= 3.4.1, < 3.4.10: Affected

    No fix published

  • mariadb Ubuntu:24.04:LTS

    Versions
    • 1:10.11.4-1
    • 1:10.11.5-3
    • 1:10.11.6-1
    • 1:10.11.6-2
    • 1:10.11.7-2ubuntu1
    • 1:10.11.7-2ubuntu2
    • 1:10.11.8-0ubuntu0.24.04.1
    • 1:10.11.11-0ubuntu0.24.04.2
    • 1:10.11.13-0ubuntu0.24.04.1
    • 1:10.11.14-0ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Ubuntu:26.10

    Versions
    • 1:11.8.6-5
    • 1:11.8.8-1
    • 1:11.8.9+ds-4ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Ubuntu:26.04:LTS

    Versions
    • 1:11.8.3-1build1
    • 1:11.8.5-1
    • 1:11.8.5-2
    • 1:11.8.5-3
    • 1:11.8.5-4
    • 1:11.8.6-1
    • 1:11.8.6-3
    • 1:11.8.6-4
    • 1:11.8.6-5
    • 1:11.8.6-5ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →