CVE catalog
CVE-2026-61700
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LO
- Severity
- Low · CVSS 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 27, 2026
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sends a LOAD DATA LOCAL INFILE COM_QUERY, a rogue or man-in-the-middle server can echo the same filename and cause the connector to transmit that file despite the disabled option. The server cannot redirect the request to an arbitrary path and can receive only the exact file already selected by the application, so exploitation requires an application that actively loads sensitive data over an untrusted connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | mariadb-connector-java | sid | 3.5.10-1 | fixed |
| Debian | mariadb-connector-java | forky | 3.5.10-1 | fixed |
| Debian | mariadb-connector-java | trixie | 2.7.6-1 | vulnerable |
| Debian | mariadb-connector-java | bookworm | 2.7.6-1 | not affected |
| Maven | org.mariadb.jdbc:mariadb-java-client | Not reported | 3.5.9 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | mariadb-connector-java | source | sid | 2.7.15-1 | not yet assigned | Not reported | Not reported |
| Debian | mariadb-connector-java | source | forky | 2.7.15-1 | not yet assigned | Not reported | Not reported |
| Debian | mariadb-connector-java | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | mariadb-connector-java | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Maven | org.mariadb.jdbc:mariadb-java-client | maven | Not reported | 3.5.9 | Not reported | GHSA-WXMM-Q36W-R9XJ | Not reported |
Notes
[trixie] mariadb-connector-java: Minor issue
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [libmariadb-java]Affected
Source package: [mariadb-connector-java]
Details (2)
2.7.6-1· all · trixieAffected
nvd · mariadb-connector-java · debian · 13
2.7.6-1· all · trixieAffected
nvd · mariadb-connector-java · debian · 13
[Debian 12 (Bookworm)]
- [libmariadb-java]Not affected
Source package: [mariadb-connector-java]
Details (2)
2.7.6-1· all · bookwormNot affected
nvd · mariadb-connector-java · debian · bookworm
2.7.6-1· all · bookwormNot affected
nvd · mariadb-connector-java · debian · bookworm
Observed:
References
- [https://github.com/advisories/GHSA-wxmm-q36w-r9xj]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-61700]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-61700]
- [https://security-tracker.debian.org/tracker/CVE-2026-61700]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61700.json]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]