CVE-2026-119281

What it actually does

The connector assumes result bytes are UTF-8 but only tracks character_set_client changes and relies on server-reported session_track_system_variables; a malicious server or MITM can suppress tracking or alter character_set_results so decoded application strings diverge from the actual bytes returned, defeating client-side validation or escaping.

Why it matters to the business

Applications may silently accept tampered data or bypass security checks during database queries, risking data corruption, logic errors, or unauthorized access with minimal attacker effort on affected Java database connections.

How an attack unfolds

An attacker with a compromised or malicious MariaDB/MySQL server (or positioned as a MITM) suppresses system variable tracking or forces a non-UTF-8 character_set_results value on the session; the connector then decodes results incorrectly, producing strings that differ from the wire bytes and allowing evasion of application validation or escaping routines.

How to fix it

Upgrade MariaDB Connector/J to version 3.3.7, 3.4.5, or 3.5.11 (or later) in all Java applications; after upgrade, enforce strict network controls and avoid reliance on untrusted database servers for session configuration.

How to confirm the fix worked

Inventory all deployments of MariaDB Connector/J and confirm the running version meets or exceeds 3.3.7 / 3.4.5 / 3.5.11; test connections against a controlled server that attempts charset manipulation and verify that mismatches are now rejected.

Typical attack path

1. Position as a malicious or compromised database server or intercept traffic via MITM
2. Suppress session_track_system_variables reporting or force a non-UTF-8 character_set_results change
3. Return query results whose bytes do not match the UTF-8 decoding expected by the client
4. Exploit the resulting string/byte mismatch to bypass validation or escaping logic

How to detect it

Examine application and database connection logs for unexpected character-set change events, decoding exceptions, or mismatches between reported and observed result encodings; correlate with session variable queries that should have been tracked.

What your security team should do

• Immediately upgrade all instances of MariaDB Connector/J to a fixed release (3.3.7, 3.4.5, or 3.5.11)
• Review and harden network paths between applications and database servers to reduce MITM exposure
• Audit application code that relies on connector-returned strings for security decisions
• Monitor for unexpected charset-related errors or data anomalies in database client logs