Live › vulnerability › CVE-2026-119281
MariaDB Connector/J, the Java driver for MariaDB and MySQL, did not reject non-UTF-8 result character set changes from the server. A malicious server or a man-in-the-middle could make decoded strings differ from the returned bytes, which can defeat validation or escaping the application relies on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Java applications that use MariaDB Connector/J 3.0.0 through the listed fixed releases to talk to MariaDB or MySQL. The risk depends on a malicious server or an attacker able to intercept the database connection, so applications connecting only to a trusted, private database over a protected network are lower risk. Teams that rely on application-side validation or escaping of decoded database strings should prioritise it.
No product ranges from the sources yet.
mariadb-java-client version in the project build file (pom.xml, build.gradle) or the resolved dependency tree.3.0.0 and 3.3.7, 3.4.5, or 3.5.11.3.3.7, 3.4.5, or 3.5.11, matching the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-119281")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.