CVE-2026-119281: MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
Summary
MariaDB Connector/J decodes every result as UTF-8 and guards charactersetclient against a change to another charset, but did not guard charactersetresults, and relied on the server's global sessiontracksystemvariables list to be told about charset changes at all.
Details
The connector learns about session variable changes through session tracking, and closes the connection when charactersetclient is switched away from UTF-8, so that its UTF-8 decoding stays correct. Two gaps remained:
- charactersetresults was not guarded: a server could switch it to another charset, after which the bytes of every result were decoded as UTF-8 although encoded otherwise. - the list of tracked variables came from the server's global sessiontracksystemvariables: a server configured, or made, not to track the character set variables could change them silently.
The fix requests an explicit session tracking list that includes both character set variables whatever the server's global setting, and closes the connection when charactersetresults is changed to a charset other than utf8, utf8mb3 or utf8mb4, as it already did for charactersetclient.
Impact
Integrity: a malicious or compromised server, or a MitM, can make the strings an application reads differ from the bytes the server returned (inappropriate encoding for the output context), which can defeat application-side validation or escaping built on those values. Exploitation requires control of the server side of the connection; no confidentiality or availability impact.
Credit
Reported by fg0x0
Other sources
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to charactersetclient. It did not reject non-UTF-8 charactersetresults changes and relied on the server's global sessiontracksystemvariables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.mariadb.jdbc:mariadb-java-clientto a version that resolves this vulnerability.Fixed in 3.5.11 - Upgrade
Upgrade
maven/org.mariadb.jdbc:mariadb-java-clientto a version that resolves this vulnerability.Fixed in 3.4.5 - Upgrade
Upgrade
maven/org.mariadb.jdbc:mariadb-java-clientto a version that resolves this vulnerability.Fixed in 3.3.7 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.3.7 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.4.5 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 3.5.11
Frequently Asked Questions
What conditions are needed for this issue to affect an application?
The application must use MariaDB Connector/J and receive results after the server changes character_set_results to a non-UTF-8 charset. The risk is greater when the server does not track character-set variables in session_track_system_variables, because such changes can occur without the connector being notified.
Can a server-wide session tracking configuration affect exposure?
Yes. The affected behavior relied on the server's global session_track_system_variables list to report character-set changes. If that list omits the relevant character-set variables, the server can change them silently from the connector's perspective.
What should be done if the connector cannot be updated immediately?
Ensure the server does not change character_set_results away from utf8, utf8mb3, or utf8mb4 for affected connections. Also ensure character-set variables are included in session tracking rather than relying on a global tracking list that may omit them.