Connector/J 2.7.15 Release Notes

Release notes for MariaDB Connector/J 2.7.15, a Stable (GA) release published 29 July 2026.

The most recent release of MariaDB Connector/J is: 3.5.10

Download Connector/J 3.5.10

Download Release Notes Changelog Connector/J Overview

Release date: 29 Jul 2026

MariaDB Connector/J 2.7.15 is a Stable (GA) release.

For an overview of MariaDB Connector/J see the About MariaDB Connector/J page

Notable Changes

• CONJ-1339 - Add the maxAllowedColumns connection option, bounding the server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1342 - The socketFactory option allows loading arbitrary bytecode through a jar: URL, enabling remote code execution when the JDBC URL is attacker-controlled (report by Qing Xu)

• CONJ-1332 - Reject multipart (larger than 16MB) packets before authentication, to prevent a pre-authentication out-of-memory condition caused by a rogue server

• CONJ-1340 - SQL injection through unescaped identifiers in the statements generated for an updatable ResultSet (thanks to jmestwa-coder)

• CONJ-1326 - Unsafe escaping in enquoteLiteral() and enquoteNCharLiteral() (thanks to jmestwa-coder)

Other

• Cap the length-encoded field length before narrowing it to an int in the row decoders

Changelog

For a complete list of changes made in MariaDB Connector/J 2.7.15, with links to detailed information on each push, see the changelog.

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}