CVE-2026-119281 mariadb-corporation CVE debrief

Who should care

Defenders who use MariaDB Connector/J in their applications should assess their exposure and verify the character set configuration of their instances. This vulnerability can lead to incorrect decoding of results, which can cause issues with data integrity.

Why it matters

This vulnerability in MariaDB Connector/J allows a server to switch character_set_results away from UTF-8 without the client noticing, which can lead to incorrect decoding of results. Defenders should prioritize verifying the character set configuration of their instances and ensuring that the connector is updated to a fixed version.

• Defenders should verify the character set configuration of their MariaDB Connector/J instances to prevent incorrect decoding of results.
• Defenders should update the connector to a fixed version to ensure the security of their applications.
• Defenders should monitor for changes to the character_set_results variable to detect potential attacks.

Technical summary

MariaDB Connector/J decodes every result as UTF-8 and guards character_set_client against a change to another charset, but did not guard character_set_results, and relied on the server's global session_track_system_variables list to be told about charset changes at all. The fix requests an explicit session tracking list that includes both character set variables whatever the server's global setting, and closes the connection when character_set_results is changed to a charset other than utf8, utf8mb3 or utf8mb4.

Defensive priority

Defenders should prioritize verifying the character set configuration of their MariaDB Connector/J instances and ensuring that the connector is updated to a fixed version.

Recommended defensive actions

• Verify the character set configuration of MariaDB Connector/J instances
• Update the connector to a fixed version (3.3.7, 3.4.5, or 3.5.11)
• Monitor for changes to the character_set_results variable
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the lack of guarding for the character_set_results variable in MariaDB Connector/J, which allows a server to switch the character set without the client noticing. This can lead to incorrect decoding of results.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.