CVE-2026-107819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107819", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-08T21:23:59.823Z", "datePublished": "2026-10-09T17:25:45.082Z", "dateUpdated": "2026-10-09T17:59:15.334Z"}, "containers": {"cna": {"title": "MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure", "problemTypes": [{"descriptions": [{"cweId": "CWE-297", "lang": "en", "description": "CWE-297: Improper Validation of Certificate with Host Mismatch", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02"}, {"name": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10"}, {"name": "https://jira.mariadb.org/browse/CONC-846", "tags": ["x_refsource_MISC"], "url": "https://jira.mariadb.org/browse/CONC-846"}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"version": ">= 3.4.1, < 3.4.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-09T17:25:45.082Z"}, "descriptions": [{"lang": "en", "value": "MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}], "source": {"advisory": "GHSA-fmq9-qjxj-qpf7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T17:59:07.078424Z", "id": "CVE-2026-107819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T17:59:15.334Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T17:59:07.078424Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T17:59:10.891Z"}}], "cna": {"title": "MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure", "source": {"advisory": "GHSA-fmq9-qjxj-qpf7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"status": "affected", "version": ">= 3.4.1, < 3.4.10"}]}], "references": [{"url": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7", "name": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02", "name": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10", "name": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.mariadb.org/browse/CONC-846", "name": "https://jira.mariadb.org/browse/CONC-846", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-297", "description": "CWE-297: Improper Validation of Certificate with Host Mismatch"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-09T17:25:45.082Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107819", "state": "PUBLISHED", "dateUpdated": "2026-10-09T17:59:15.334Z", "dateReserved": "2026-10-08T21:23:59.823Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-09T17:25:45.082Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "server", "vendor": "MariaDB", "versions": [{"status": "affected", "version": ">= 3.4.1, < 3.4.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}], "id": "CVE-2026-107819", "lastModified": "2026-10-13T15:27:56.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107819", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T17:59:07.078424Z", "version": "2.0.3"}}]}, "published": "2026-10-09T18:17:03.533", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02"}, {"source": "security-advisories@github.com", "url": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10"}, {"source": "security-advisories@github.com", "url": "https://jira.mariadb.org/browse/CONC-846"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-297"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "mariadb-connector-c: mariadb-connector-c: Information disclosure via improper TLS hostname verification", "id": "2548735", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548735"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in MariaDB Connector/C. During automatic Transport Layer Security (TLS) connection setup, the library verifies certificate trust but fails to confirm that the server hostname matches the certificate before switching authentication methods. An active man-in-the-middle (MitM) attacker with a valid certificate for a different domain can exploit this vulnerability to intercept the encrypted connection, request plaintext authentication, and capture database passwords."], "name": "CVE-2026-107819", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb-connector-c", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb-connector-c", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb-connector-c", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb-connector-c", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-09T17:25:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107819\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107819\nhttps://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7\nhttps://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02\nhttps://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10\nhttps://jira.mariadb.org/browse/CONC-846"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.1,3.4.10)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "server", "source": "cna", "vendor": "MariaDB"}, "product": "server", "vendor": "mariadb"}], "created": "2026-10-09T19:00:15.334049+00:00", "updated": "2026-10-10T02:30:05.688059+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$server"]}