Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-119281EUVD-2026-113388GHSA-GRFQ-R75J-RW9X

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.3.7, 3.4.5, 3.5.11
None on Exploit-DB, Metasploit or GitHub

Summary

MariaDB Connector/J, the Java library used to connect applications to MariaDB and MySQL databases, is affected in versions from 3.0.0 up to (but not including) the fixed releases. A malicious or compromised database server, or an attacker positioned between client and server, could cause the connector to decode returned data with the wrong character set, potentially bypassing application-side validation or escaping.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • mariadb-corporation mariadb-connector-j

    From 3.0.0 · fixed in 3.3.7; From 3.4.0 · fixed in 3.4.5; From 3.5.0 · fixed in 3.5.11

References 7

GitHub · mariadb-corporation/mariadb-connector-j