mariadb-corporation/mariadb-connector-j 2.7.15

MariaDB Connector/Java 2.7.15

on GitHub

2.7.15 (Jul 2026)

Full Changelog

• CONJ-1332 Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1326 Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1339 Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1340 SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)