CVE-2026-119281mediumCWE-838

CVE-2026-119281: medium-severity vulnerability in mariadb-corporation mariadb-connector-j

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Published · Updated

Follow this CVE+ Monitor mariadb-connector-j+ Monitor org.mariadb.jdbc:mariadb-java-client

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.3%
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
mariadb-corporation · mariadb-connector-j
Related CVEs — mariadb-corporation mariadb-connector-j

In the same product, most dangerous first.

CVE-2026-55858MEDIUMMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientEPSS 0.9%CVE-2026-55856MEDIUMMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeEPSS 0.4%CVE-2026-55857MEDIUMMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsEPSS 0.4%CVE-2026-61700LOWMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsEPSS 0.4%CVE-2026-119278MEDIUMMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationEPSS 0.4%CVE-2026-119279MEDIUMMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsEPSS 0.4%