Bug 2563687 (CVE-2026-119281)

Summary: CVE-2026-119281 org.mariadb.jdbc/mariadb-java-client: mariadb-connector-j: Security feature bypass via unvalidated character set changes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ant, aschwart, aszczucz, boliveir, ccranfor, cescoffi, drichtar, eglynn, ehelms, fmongiar, ggainey, gsmet, janstey, jjoyce, jmartisk, jpasqual, jpechane, jpretori, jschluet, juwatts, lblicha, lhh, manderse, mburns, mdellweg, mgarciac, mhulan, mposolda, nmoumoul, ogajduse, olubyans, osousa, ozzy, pcreech, pjindal, rchan, rguimara, rhel-process-autobot, rmartinc, sbiarozk, smallamp, ssilvert, sthorger, tmalecek, varjain, vmuzikar, watson-tool-maintainers, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MariaDB Connector/J. The database connector fails to properly validate changes to the result character set and incorrectly assumes all returned data is UTF-8 encoded. A malicious database server or an attacker intercepting network communication (a machine-in-the-middle attacker) can alter the character set without notification, causing database responses to decode into unexpected text strings. This discrepancy may allow an attacker to bypass application-side input validation, sanitization, or escaping mechanisms.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 21:14:12 UTC 
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.