{"id":"CVE-2026-119281","aliases":["DEBIAN-CVE-2026-119281","EUVD-2026-113388","GHSA-grfq-r75j-rw9x","UBUNTU-CVE-2026-119281","openSUSE-SU-2026:12401-1"],"status":"published","title":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00283,"percentile":0.21101,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-838"],"published":"2026-10-29T20:58:39Z","modified":"2026-11-05T07:59:54Z","fixes":[{"ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","fixed_in":["3.3.7","3.4.5","3.5.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.15-1","2.7.6-1","3.5.10-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.15-1","2.7.6-1","3.5.10-1"]},{"source":"osv","ecosystem":"Debian:14","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.15-1","2.7.6-1","3.5.10-1"]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.7"}]}],"versions":["3.0.1-beta","3.0.10","3.0.11","3.0.2-rc","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6"]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}]}],"versions":["3.4.0","3.4.1","3.4.2","3.4.3","3.4.4"]},{"source":"osv","ecosystem":"Maven","package":"org.mariadb.jdbc:mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.11"}]}],"versions":["3.5.0","3.5.1","3.5.10","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-1build2","2.5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.2-1","2.7.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mariadb-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-1","2.7.6-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mariadb-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.11-1.1"}]}],"bundled":7}],"products":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j"}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119281","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-grfq-r75j-rw9x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119281.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-119281","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-119281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-119281","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119281","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-119281","title":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","status":"published","published":"2026-10-29T20:58:39.322Z","modified":"2026-11-04T01:48:15.598Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-838"],"updated_at":"2026-11-04T02:49:29.029968Z"}],"euvd":[{"id":"EUVD-2026-113388","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","status":"published","published":"2026-10-29T20:58:39Z","modified":"2026-11-04T01:48:15Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T03:57:29.097782Z"}],"ghsa":[{"id":"GHSA-grfq-r75j-rw9x","title":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing","description":"## Summary\n\nMariaDB Connector/J decodes every result as UTF-8 and guards\n`character_set_client` against a change to another charset, but did not guard\n`character_set_results`, and relied on the server's global\n`session_track_system_variables` list to be told about charset changes at all.\n\n## Details\n\nThe connector learns about session variable changes through session tracking,\nand closes the connection when `character_set_client` is switched away from UTF-8,\nso that its UTF-8 decoding stays correct. Two gaps remained:\n\n- `character_set_results` was not guarded: a server could switch it to another\n  charset, after which the bytes of every result were decoded as UTF-8 although\n  encoded otherwise.\n- the list of tracked variables came from the server's global\n  `session_track_system_variables`: a server configured, or made, not to track\n  the character set variables could change them silently.\n\nThe fix requests an explicit session tracking list that includes both character\nset variables whatever the server's global setting, and closes the connection\nwhen `character_set_results` is changed to a charset other than `utf8`, `utf8mb3`\nor `utf8mb4`, as it already did for `character_set_client`.\n\n## Impact\n\nIntegrity: a malicious or compromised server, or a MitM, can make the strings an\napplication reads differ from the bytes the server returned (inappropriate\nencoding for the output context), which can defeat application-side validation\nor escaping built on those values. Exploitation requires control of the server\nside of the connection; no confidentiality or availability impact.\n\n## Credit\n\nReported by fg0x0","status":"published","published":"2026-10-30T22:59:45Z","modified":"2026-10-30T22:59:48Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T14:41:41.028239Z"}],"nvd":[{"id":"CVE-2026-119281","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","status":"published","published":"2026-10-29T21:17:21.71Z","modified":"2026-11-04T02:17:18.94Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-838"],"updated_at":"2026-11-04T06:53:34.694679Z"}],"osv":[{"id":"CVE-2026-119281","title":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","status":"published","published":"2026-10-29T20:58:39.322Z","modified":"2026-11-05T07:59:54.012084196Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-838"],"updated_at":"2026-11-05T09:08:14.330889Z"},{"id":"DEBIAN-CVE-2026-119281","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","status":"published","published":"2026-10-29T21:17:21.71Z","modified":"2026-11-04T09:47:23.518857375Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"GHSA-grfq-r75j-rw9x","title":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing","description":"## Summary\n\nMariaDB Connector/J decodes every result as UTF-8 and guards\n`character_set_client` against a change to another charset, but did not guard\n`character_set_results`, and relied on the server's global\n`session_track_system_variables` list to be told about charset changes at all.\n\n## Details\n\nThe connector learns about session variable changes through session tracking,\nand closes the connection when `character_set_client` is switched away from UTF-8,\nso that its UTF-8 decoding stays correct. Two gaps remained:\n\n- `character_set_results` was not guarded: a server could switch it to another\n  charset, after which the bytes of every result were decoded as UTF-8 although\n  encoded otherwise.\n- the list of tracked variables came from the server's global\n  `session_track_system_variables`: a server configured, or made, not to track\n  the character set variables could change them silently.\n\nThe fix requests an explicit session tracking list that includes both character\nset variables whatever the server's global setting, and closes the connection\nwhen `character_set_results` is changed to a charset other than `utf8`, `utf8mb3`\nor `utf8mb4`, as it already did for `character_set_client`.\n\n## Impact\n\nIntegrity: a malicious or compromised server, or a MitM, can make the strings an\napplication reads differ from the bytes the server returned (inappropriate\nencoding for the output context), which can defeat application-side validation\nor escaping built on those values. Exploitation requires control of the server\nside of the connection; no confidentiality or availability impact.\n\n## Credit\n\nReported by fg0x0","status":"published","published":"2026-10-30T22:59:45Z","modified":"2026-10-30T23:15:08.580857209Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-838"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"UBUNTU-CVE-2026-119281","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","status":"published","published":"2026-10-29T21:17:00Z","modified":"2026-11-05T04:42:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"openSUSE-SU-2026:12401-1","title":"mariadb-java-client-3.5.11-1.1 on GA media","description":"These are all security issues fixed in the mariadb-java-client-3.5.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T17:23:21.433924059Z","updated_at":"2026-11-04T17:43:22.558805Z"}]}}