CVE-2026-119281: MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
MariaDB Connector/J decodes every result as UTF-8 and guards
character_set_client against a change to another charset, but did not guard
character_set_results, and relied on the server’s global
session_track_system_variables list to be told about charset changes at all.
References
- github.com/advisories/GHSA-grfq-r75j-rw9x
- github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623
- github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423
- github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a
- github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7
- github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5
- github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11
- github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x
- nvd.nist.gov/vuln/detail/CVE-2026-119281
Code Behaviors & Features
Detect and mitigate CVE-2026-119281 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →