PT-2026-83376

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver does not require a secure transport before using clear-text password authentication plugins. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest...

PT-2026-83375

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver encodes and decodes all character data assuming the connection character set is UTF-8. A server can announce a mid-session change to the character set client variable throu...

CVE-2026-55860: Cleartext Transmission of Sensitive Information

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...

CVE-2026-55859: Improper Encoding or Escaping of Output

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CLSA-2026-1781830552 TuxCare security update for org.springframework.data:spring-data-r2dbc (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 1 CVE. Fixed in 1.5.18-tuxcare.2...

CLSA-2025-1754872136 TuxCare security update for org.springframework.data:spring-data-r2dbc (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 2 CVEs. Fixed in 1.5.18-tuxcare.1...

PT-2026-75118

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 1 CVE. Fixed in 1.5.18-tuxcare.2...

PT-2026-73513

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 2 CVEs. Fixed in 1.5.18-tuxcare.1...

EUVD-2022-1817

Malicious code in bioql PyPI...

Spring Data JDBC and R2DBC 4.0 will support Composite IDs

I'm happy to announce, that Spring Data JDBC and R2DBC finally support Composite IDs starting with version 4.0.0-M4. Most of you probably know, but just to make sure everyone has the same understanding: From the database point of view a composite id or composite key is a primary key that consists...

This Week in Spring - October 29th, 2024

Hi, Spring fans! How're things? It's almost Halloween! I'm so excited! I'm going as a PHP program. Boooooooo...t. I'm writing this from the amazing Vaadin Create conference in Frankfurt, Germany, about to do my keynote for an amazing, Spring-loving audience here. So, without further ado, let's di...

CVE-2024-23689

Summary: CVE-2024-23689 affects ClickHouse Java libraries (clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, com.clickhouse:clickhouse-client) with versions

CVE-2024-23689

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when...

CVE-2024-23689 ClickHouse Client Certificate Password Exposure

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when...

CVE-2024-23689: Generation of Error Message Containing Sensitive Information

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when...

A Bootiful Podcast: Tadaya Tsuyukubo, creator of R2DBC Proxy, DataSource Proxy, and more

HI, Spring fans! In this installment Josh Long talks to R2DBC Proxy creator Tadaya Tsuyukubo, @ttddyy, creator of R2DBC Proxy and others...

PT-2023-32950

Name of the Vulnerable Software and Affected Versions clickhouse-r2dbc versions less than 0.4.6 com.clickhouse:clickhouse-jdbc versions less than 0.4.6 com.clickhouse:clickhouse-client versions less than 0.4.6 Description The issue allows unauthorized users to gain access to client certificate...

This Week in Spring - March 28th, 202

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm reporting to you from Los Angeles, where my family and I have gone for my daughter's spring break. We're going to survey some prospective colleges and we're going to Disneyland. Needless to say, I'm doubly glad to have al...

CVE-2022-24815

JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications...

Sql injection

JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications...