Character Set Validation Vulnerability in MariaDB Connector/J
CVE-2026-119281
What is CVE-2026-119281?
The MariaDB Connector/J, a library for connecting Java applications to MariaDB and MySQL databases, previously mishandled character set validation between result bytes and client settings when versions 3.0.0 to 3.3.7, 3.4.5, and 3.5.11 were used. Specifically, it inappropriately assumed that result bytes were always UTF-8 without adequately discarding invalid character set results. This flaw enabled attackers with control over the database server or in a position to execute man-in-the-middle attacks to manipulate character set reporting. As a result, the application may receive improperly validated strings, thereby introducing the risk of bypassing validation mechanisms and leading to possible security breaches. This issue is addressed in later versions 3.3.7, 3.4.5, and 3.5.11.
Affected Version(s)
mariadb-connector-j >= 3.0.0, < 3.3.7 < 3.0.0, 3.3.7
mariadb-connector-j >= 3.4.0, < 3.4.5 < 3.4.0, 3.4.5
mariadb-connector-j >= 3.5.0, < 3.5.11 < 3.5.0, 3.5.11