Connector/J 3.5.10 Release Notes

Release notes for MariaDB Connector/J 3.5.10, a Stable (GA) release published 29 July 2026.

Download Release Notes Changelog Connector/J Overview

Release date: 29 Jul 2026

MariaDB Connector/J 3.5.10 is a Stable (GA) release.

For an overview of MariaDB Connector/J see the About MariaDB Connector/J page

Key Enhancements

• CONJ-1333 - Add the maxAllowedPacket connection option, bounding the size of packets the driver sends and accepts

• CONJ-1339 - Add the maxAllowedColumns connection option, bounding the server-announced column count (report by fg0x0)

• CONJ-1330 - Add Infer static analysis to CI

Bugs Fixed

• CONJ-1342 - The socketFactory option allows loading arbitrary bytecode through a jar: URL, enabling remote code execution when the JDBC URL is attacker-controlled (report by Qing Xu)

• CONJ-1332 - Reject multipart (larger than 16MB) packets before authentication, to prevent a pre-authentication out-of-memory condition caused by a rogue server

• CONJ-1340 - SQL injection through unescaped identifiers in the statements generated for an updatable ResultSet (thanks to jmestwa-coder)

• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain and identity validation instead of validating up front (thanks to jmestwa-coder)

• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter cannot be rendered (thanks to jmestwa-coder)

• CONJ-1326 - Unsafe escaping in enquoteLiteral() and enquoteNCharLiteral() (thanks to jmestwa-coder)

• CONJ-1328 - The restrictedAuth allowlist is matched with a substring contains() instead of equality (thanks to jmestwa-coder)

• CONJ-1338 - Validate that length-encoded integers fit a non-negative int before using them as a length (report by fg0x0)

• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)

• CONJ-1327 - Align TLS hostname verification with TLS libraries: the certificate CN is ignored only when a SAN entry of the host type is present (thanks to jmestwa-coder)

• CONJ-1336 - CONJ-1282 regression: a TLS connection fails when the JDBC hostname is an absolute fully qualified domain name ending with a trailing dot (report by Shaswata, thanks to Pepo48 for the pull request)

• CONJ-1337 - Limit the parsec authentication PBKDF2 iteration factor for the duration of the connection

• CONJ-1335 - getGeneratedKeys() throws an SQLDataException with an "integer overflow" message after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute

Changelog

For a complete list of changes made in MariaDB Connector/J 3.5.10, with links to detailed information on each push, see the changelog.

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}