mariadb-corporation/mariadb-connector-j 3.4.4

MariaDB Connector/Java 3.4.4

on GitHub

3.4.4 (Jul 2026)

Full Changelog

Notable Changes

• CONJ-1339 Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1332 Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1326 Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1329 LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
• CONJ-1340 SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password
  is supplied (report by fg0x0)
• CONJ-1328 restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)