ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-119281

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · MariaDB Connector/J: Server could

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119281. EPSS is 0.28%. Act only if a listed version of MariaDB Connector/J: Server could is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (MariaDB Connector/J: Server could).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.28%
Remediation
Version ranges on file
Affected products
Maven org.mariadb.jdbc:mariadb-java-client · maven org.mariadb.jdbc · maven org.mariadb.jdbc:mariadb-java-client

## Summary MariaDB Connector/J decodes every result as UTF-8 and guards against a change to another charset, but did not guard , and relied on the server's global list to be told about charset changes at all. ## Details The connector learns about session variable changes through session tracking, and closes the connection when is switched away from UTF-8, so that its UTF-8 decoding stays correct. Two gaps remained: - was not guarded: a server could switch it to another charset, after which the bytes of every result were decoded as UTF-8 although encoded otherwise. - the list of tracked variables came from the server's global : a server configured, or made, not to track the character set variables could change them silently. The fix requests an explicit session tracking list that includes both character set variables whatever the server's global setting, and closes the connection when is changed to a charset other than , or , as it already did for . ## Impact Integrity: a malicious or compromised server, or a MitM, can make the strings an application reads differ from the bytes the server returned (inappropriate encoding for the output context), which can defeat application-side validation or escaping built on those values. Exploitation requires control of the server side of the connection; no confidentiality or availability impact. ## Credit Reported by fg0x0

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Maven org.mariadb.jdbc:mariadb-java-client3.0.0 → 3.3.7
  • Maven org.mariadb.jdbc:mariadb-java-client3.4.0 → 3.4.5
  • Maven org.mariadb.jdbc:mariadb-java-client3.5.0 → 3.5.11
  • maven org.mariadb.jdbcversion unspecified
  • maven org.mariadb.jdbc:mariadb-java-client>= 3.0.0, < 3.3.7
  • maven org.mariadb.jdbc:mariadb-java-client>= 3.4.0, < 3.4.5
  • maven org.mariadb.jdbc:mariadb-java-client>= 3.5.0, < 3.5.11

How to fix CVE-2026-119281

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119281. EPSS is 0.28%. Act only if a listed version of MariaDB Connector/J: Server could is installed.

Which versions are affected?

Compare what you have installed with 3.0.0 → 3.3.7, 3.4.0 → 3.4.5, 3.5.0 → 3.5.11, >= 3.0.0, < 3.3.7, >= 3.4.0, < 3.4.5, >= 3.5.0, < 3.5.11. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-838. EPSS 0.28%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

MariaDB security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ## Summary MariaDB Connector/J decodes every result as UTF-8 and guards against a change to another charset, but did not guard , and relied on the server's global list to be told about charset changes at all. ## Details The connector learns about session variable changes through session tracking, and closes the connection when is switched away from UTF-8, so that its UTF-8 decoding stays correct.

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    org.mariadb.jdbc:mariadb-java-client fixed in 3.3.7; org.mariadb.jdbc:mariadb-java-client fixed in 3.4.5; org.mariadb.jdbc:mariadb-java-client fixed in 3.5.11

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    org.mariadb.jdbc:mariadb-java-client fixed in 3.3.7

  4. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    org.mariadb.jdbc:mariadb-java-client fixed in 3.4.5

  5. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    org.mariadb.jdbc:mariadb-java-client fixed in 3.5.11

  6. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ## Summary MariaDB Connector/J decodes every result as UTF-8 and guards against a change to another charset, but did not guard , and relied on the server's global list to be told about charset changes at all. ## Details The connector learns about session variable changes through session tracking, and closes the connection when is switched away from UTF-8, so that its UTF-8 decoding stays correct.

Sources

  • CVE.orgVulnerability recordCVE-2026-119281

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-grfq-r75j-rw9x

    MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119281

    MariaDB Connector/J decodes every result as UTF-8 and guards character_set_client against a change to another charset, but did not guard character_set_results, and relied on the server's global session_track_system_variables list to be told about charset changes at all.

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-grfq-r75j-rw9x

    MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

    osv.dev

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgOct 31, 2026
  • GitLab Advisory DatabaseOct 31, 2026
  • GitHub Advisory DatabaseOct 31, 2026
  • OpenSSF OSV / OSV ScannerOct 31, 2026