Connector/J 3.3.6 Release Notes

Release notes for MariaDB Connector/J 3.3.6, a Stable (GA) release published 29 July 2026.

The most recent release of MariaDB Connector/J is: 3.5.10

Download Connector/J 3.5.10

Download Release Notes Changelog Connector/J Overview

Release date: 29 Jul 2026

MariaDB Connector/J 3.3.6 is a Stable (GA) release.

For an overview of MariaDB Connector/J see the About MariaDB Connector/J page

Notable Changes

• CONJ-1339 - Add the maxAllowedColumns connection option, bounding the server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1342 - The socketFactory option allows loading arbitrary bytecode through a jar: URL, enabling remote code execution when the JDBC URL is attacker-controlled (report by Qing Xu)

• CONJ-1332 - Reject multipart (larger than 16MB) packets before authentication, to prevent a pre-authentication out-of-memory condition caused by a rogue server

• CONJ-1340 - SQL injection through unescaped identifiers in the statements generated for an updatable ResultSet (thanks to jmestwa-coder)

• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter cannot be rendered (thanks to jmestwa-coder)

• CONJ-1326 - Unsafe escaping in enquoteLiteral() and enquoteNCharLiteral() (thanks to jmestwa-coder)

• CONJ-1328 - The restrictedAuth allowlist is matched with a substring contains() instead of equality (thanks to jmestwa-coder)

• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)

Changelog

For a complete list of changes made in MariaDB Connector/J 3.3.6, with links to detailed information on each push, see the changelog.

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}