---
id: CVE-2026-119281
aliases:
  - GHSA-grfq-r75j-rw9x
title: >-
  MariaDB Connector/J: Server could switch character_set_results away from UTF-8
  without the client noticing
summary: >-
  MariaDB Connector/J: Server could switch character_set_results away from UTF-8
  without the client noticing
severity: medium
cvss: 5.9
cwe:
  - CWE-838
vendor: mariadb
product: 'org.mariadb.jdbc:mariadb-java-client'
ecosystem: maven
affected:
  - 'org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7'
  - 'org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5'
  - 'org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.11'
patched:
  - 'org.mariadb.jdbc:mariadb-java-client 3.3.7'
  - 'org.mariadb.jdbc:mariadb-java-client 3.4.5'
  - 'org.mariadb.jdbc:mariadb-java-client 3.5.11'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T22:59:48Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-grfq-r75j-rw9x'
references:
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-119281'
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11
  - url: 'https://github.com/advisories/GHSA-grfq-r75j-rw9x'
tags:
  - ghsa
  - maven
epss: 0.00283
epssPercentile: 0.20892
ingestedAt: '2026-10-30T23:11:25.782Z'
---

## Overview

## Summary

MariaDB Connector/J decodes every result as UTF-8 and guards
`character_set_client` against a change to another charset, but did not guard
`character_set_results`, and relied on the server's global
`session_track_system_variables` list to be told about charset changes at all.

## Details

The connector learns about session variable changes through session tracking,
and closes the connection when `character_set_client` is switched away from UTF-8,
so that its UTF-8 decoding stays correct. Two gaps remained:

- `character_set_results` was not guarded: a server could switch it to another
  charset, after which the bytes of every result were decoded as UTF-8 although
  encoded otherwise.
- the list of tracked variables came from the server's global
  `session_track_system_variables`: a server configured, or made, not to track
  the character set variables could change them silently.

The fix requests an explicit session tracking list that includes both character
set variables whatever the server's global setting, and closes the connection
when `character_set_results` is changed to a charset other than `utf8`, `utf8mb3`
or `utf8mb4`, as it already did for `character_set_client`.

## Impact

Integrity: a malicious or compromised server, or a MitM, can make the strings an
application reads differ from the bytes the server returned (inappropriate
encoding for the output context), which can defeat application-side validation
or escaping built on those values. Exploitation requires control of the server
side of the connection; no confidentiality or availability impact.

## Credit

Reported by fg0x0

## Affected packages

- `org.mariadb.jdbc:mariadb-java-client >= 3.0.0, < 3.3.7`
- `org.mariadb.jdbc:mariadb-java-client >= 3.4.0, < 3.4.5`
- `org.mariadb.jdbc:mariadb-java-client >= 3.5.0, < 3.5.11`

## Remediation

Upgrade to a patched release:

- `org.mariadb.jdbc:mariadb-java-client 3.3.7`
- `org.mariadb.jdbc:mariadb-java-client 3.4.5`
- `org.mariadb.jdbc:mariadb-java-client 3.5.11`