Vulnerability-Lookup

GHSA-GRFQ-R75J-RW9X

Vulnerability from github – Published: 2026-10-30 22:59 – Updated: 2026-10-30 22:59

Summary

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Details

Summary

MariaDB Connector/J decodes every result as UTF-8 and guards character_set_client against a change to another charset, but did not guard character_set_results, and relied on the server's global session_track_system_variables list to be told about charset changes at all.

Details

The connector learns about session variable changes through session tracking, and closes the connection when character_set_client is switched away from UTF-8, so that its UTF-8 decoding stays correct. Two gaps remained:

character_set_results was not guarded: a server could switch it to another charset, after which the bytes of every result were decoded as UTF-8 although encoded otherwise.
the list of tracked variables came from the server's global session_track_system_variables: a server configured, or made, not to track the character set variables could change them silently.

The fix requests an explicit session tracking list that includes both character set variables whatever the server's global setting, and closes the connection when character_set_results is changed to a charset other than utf8, utf8mb3 or utf8mb4, as it already did for character_set_client.

Impact

Integrity: a malicious or compromised server, or a MitM, can make the strings an application reads differ from the bytes the server returned (inappropriate encoding for the output context), which can defeat application-side validation or escaping built on those values. Exploitation requires control of the server side of the connection; no confidentiality or availability impact.

Credit

Reported by fg0x0

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mariadb.jdbc:mariadb-java-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mariadb.jdbc:mariadb-java-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mariadb.jdbc:mariadb-java-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0"
            },
            {
              "fixed": "3.5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-119281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-838"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-30T22:59:45Z",
    "nvd_published_at": "2026-10-29T21:17:21Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nMariaDB Connector/J decodes every result as UTF-8 and guards\n`character_set_client` against a change to another charset, but did not guard\n`character_set_results`, and relied on the server\u0027s global\n`session_track_system_variables` list to be told about charset changes at all.\n\n## Details\n\nThe connector learns about session variable changes through session tracking,\nand closes the connection when `character_set_client` is switched away from UTF-8,\nso that its UTF-8 decoding stays correct. Two gaps remained:\n\n- `character_set_results` was not guarded: a server could switch it to another\n  charset, after which the bytes of every result were decoded as UTF-8 although\n  encoded otherwise.\n- the list of tracked variables came from the server\u0027s global\n  `session_track_system_variables`: a server configured, or made, not to track\n  the character set variables could change them silently.\n\nThe fix requests an explicit session tracking list that includes both character\nset variables whatever the server\u0027s global setting, and closes the connection\nwhen `character_set_results` is changed to a charset other than `utf8`, `utf8mb3`\nor `utf8mb4`, as it already did for `character_set_client`.\n\n## Impact\n\nIntegrity: a malicious or compromised server, or a MitM, can make the strings an\napplication reads differ from the bytes the server returned (inappropriate\nencoding for the output context), which can defeat application-side validation\nor escaping built on those values. Exploitation requires control of the server\nside of the connection; no confidentiality or availability impact.\n\n## Credit\n\nReported by fg0x0",
  "id": "GHSA-grfq-r75j-rw9x",
  "modified": "2026-10-30T22:59:45Z",
  "published": "2026-10-30T22:59:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing"
}

CVE-2026-119281 (GCVE-0-2026-119281)

Vulnerability from cvelistv5 – Published: 2026-10-29 20:58 – Updated: 2026-10-29 20:58

Title

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Summary

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-838 - Inappropriate Encoding for Output Context

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8044 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_CONFIRM
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mariadb-corporation	mariadb-connector-j	Affected: >= 3.0.0, < 3.3.7 Affected: >= 3.4.0, < 3.4.5 Affected: >= 3.5.0, < 3.5.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mariadb-connector-j",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0, \u003c 3.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server\u0027s global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-838",
              "description": "CWE-838: Inappropriate Encoding for Output Context",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:58:39.322Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
        }
      ],
      "source": {
        "advisory": "GHSA-grfq-r75j-rw9x",
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119281",
    "datePublished": "2026-10-29T20:58:39.322Z",
    "dateReserved": "2026-10-29T18:50:28.064Z",
    "dateUpdated": "2026-10-29T20:58:39.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-GRFQ-R75J-RW9X

Summary

Details

Impact

Credit

CVE-2026-119281 (GCVE-0-2026-119281)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour