Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-119281

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

mariadb-corporation mariadb-connector-j

  • >= 3.0.0, < 3.3.7affected
  • >= 3.4.0, < 3.4.5affected
  • >= 3.5.0, < 3.5.11affected

References