{"id":"CVE-2026-119281","kind":"vulnerability","aliases":["CVE-2026-119281"],"related":[],"title":"MariaDB Connector/J: result charset change can bypass Java string validation","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, did not reject non-UTF-8 result character set changes from the server. A malicious server or a man-in-the-middle could make decoded strings differ from the returned bytes, which can defeat validation or escaping the application relies on.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdbc","mariadb","mysql","package"],"not_affected_if":["default-config","trusted-database-only"],"how_to_check":"- Find the `mariadb-java-client` version in the project build file (`pom.xml`, `build.gradle`) or the resolved dependency tree.\n- Check whether the version is between `3.0.0` and `3.3.7`, `3.4.5`, or `3.5.11`.","fix":"- Upgrade to `3.3.7`, `3.4.5`, or `3.5.11`, matching the release line in use.","status":"open","published_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:46+00:00","updated_at":"2026-10-29T21:28:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `3.3.7`, `3.4.5`, or `3.5.11`, matching the release line in use.","reach":"network","title":"MariaDB Connector/J: result charset change can bypass Java string validation","impact":"medium","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, did not reject non-UTF-8 result character set changes from the server. A malicious server or a man-in-the-middle could make decoded strings differ from the returned bytes, which can defeat validation or escaping the application relies on.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mariadb","mysql","jdbc"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"decoded strings differ from returned bytes, defeating app validation","analyst_note":"","how_to_check":"- Find the `mariadb-java-client` version in the project build file (`pom.xml`, `build.gradle`) or the resolved dependency tree.\n- Check whether the version is between `3.0.0` and `3.3.7`, `3.4.5`, or `3.5.11`.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","trusted-database-only"],"who_is_affected":"Java applications that use MariaDB Connector/J 3.0.0 through the listed fixed releases to talk to MariaDB or MySQL. The risk depends on a malicious server or an attacker able to intercept the database connection, so applications connecting only to a trusted, private database over a protected network are lower risk. Teams that rely on application-side validation or escaping of decoded database strings should prioritise it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4277,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119281':13A,16A '-2026':12A,15A '-8':102C '3.0.0':89C '3.3.7':91C,190C '3.4.5':92C,191C '3.5.11':94C,193C '8':37B,118C 'applic':71B,79C,163C,173C 'application-sid':172C 'assum':97C 'attack':153C 'bypass':7A 'byte':63B,99C,169C 'chang':5A,41B,106C,122C,140C,158C 'charact':39B,108C,119C,138C 'character-set':137C 'charset':4A,161C 'client':110C 'compromis':144C 'configur':134C 'connect':78C 'connector':96C 'connector/j':2A,23B,74C 'could':55B,154C 'cve':11A,14A 'databas':87C 'decod':57B,182C 'defeat':66B,171C 'depend':179C 'develop':80C 'differ':59B,165C 'driver':26B 'escap':69B,177C 'fix':187C 'global':129C 'guard':104C 'issu':185C 'java':8A,17B,25B,82C 'jdbc':18B 'machin':149C 'machine-in-the-middl':148C 'make':56B 'malici':46B,142C 'man':51B 'man-in-the-middl':50B 'mariadb':1A,19B,22B,28B,73C,84C 'middl':54B,152C 'mysql':20B,30B,86C 'non':35B,116C 'non-utf':34B,115C 'packag':21B 'potenti':170C 'reject':33B,114C 'reli':72B,124C 'report':136C 'result':3A,38B,98C,121C,160C 'return':62B,168C 'server':44B,47B,127C,145C 'session':130C 'set':40B,109C,120C,139C 'side':174C 'string':9A,58B,164C 'suppress':155C 'system':132C 'track':131C,156C 'use':76C 'utf':36B,101C,117C 'valid':10A,67B,175C 'valu':183C 'variabl':133C 'version':189C","nicknames":[],"mitigations":[],"who_affected":"Java applications that use MariaDB Connector/J 3.0.0 through the listed fixed releases to talk to MariaDB or MySQL. The risk depends on a malicious server or an attacker able to intercept the database connection, so applications connecting only to a trusted, private database over a protected network are lower risk. Teams that rely on application-side validation or escaping of decoded database strings should prioritise it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119281","severity":null,"published_at":"2026-10-29T21:17:21+00:00","modified_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}