MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
Impact
MariaDB Connector/J decodes every result as UTF-8 and guards character_set_client against a change to another charset, but did not guard character_set_results, and relied on the server's global session_track_system_variables list to be told about charset changes at all.
Source excerpt · OSVExploitation requires control of the server side of the connection; no confidentiality or availability impact.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 3.0.0 before 3.3.7Ecosystem versions | 3.3.7 |
| From 3.4.0 before 3.4.5Ecosystem versions | 3.4.5 |
| From 3.5.0 before 3.5.11Ecosystem versions | 3.5.11 |
Version evidence: OSV · GHSA-grfq-r75j-rw9x
View original version evidence (40 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
mariadb-corporation · GitHub_M
mariadb-connector-j
3 ranges
mariadb-corporation · GitHub_M
mariadb-connector-j
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 3.0.0, < 3.3.7
>= 3.4.0, < 3.4.5
>= 3.5.0, < 3.5.11
Other versions: unknown
Original source description
Summary
MariaDB Connector/J decodes every result as UTF-8 and guards
character_set_client against a change to another charset, but did not guard
character_set_results, and relied on the server's global
session_track_system_variables list to be told about charset changes at all.
Details
The connector learns about session variable changes through session tracking,
and closes the connection when character_set_client is switched away from UTF-8,
so that its UTF-8 decoding stays correct. Two gaps remained:
character_set_resultswas not guarded: a server could switch it to another charset, after which the bytes of every result were decoded as UTF-8 although encoded otherwise.- the list of tracked variables came from the server's global
session_track_system_variables: a server configured, or made, not to track the character set variables could change them silently.
The fix requests an explicit session tracking list that includes both character
set variables whatever the server's global setting, and closes the connection
when character_set_results is changed to a charset other than utf8, utf8mb3
or utf8mb4, as it already did for character_set_client.
Impact
Integrity: a malicious or compromised server, or a MitM, can make the strings an application reads differ from the bytes the server returned (inappropriate encoding for the output context), which can defeat application-side validation or escaping built on those values. Exploitation requires control of the server side of the connection; no confidentiality or availability impact.
Credit
Reported by fg0x0
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-119281View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.