CVE-2026-119281 is a medium-severity (CVSS 5.9) CWE-838 vulnerability in org.mariadb.jdbc:mariadb-java-client. A fix is available for org.mariadb.jdbc:mariadb-java-client — see the affected versions and patch details below.
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-119281 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 397,508 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
org.mariadb.jdbc:mariadb-java-client☕org.mariadb.jdbc:mariadb-java-client☕org.mariadb.jdbc:mariadb-java-clientReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Summary
MariaDB Connector/J decodes every result as UTF-8 and guards
character_set_client against a change to another charset, but did not guard
character_set_results, and relied on the server's global
session_track_system_variables list to be told about charset changes at all.
Details
The connector learns about session variable changes through session tracking,
and closes the connection when character_set_client is switched away from UTF-8,
so that its UTF-8 decoding stays correct. Two gaps remained:
character_set_resultswas not guarded: a server could switch it to another charset, after which the bytes of every result were decoded as UTF-8 although encoded otherwise.- the list of tracked variables came from the server's global
session_track_system_variables: a server configured, or made, not to track the character set variables could change them silently.
The fix requests an explicit session tracking list that includes both character
set variables whatever the server's global setting, and closes the connection
when character_set_results is changed to a charset other than utf8, utf8mb3
or utf8mb4, as it already did for character_set_client.
Impact
Integrity: a malicious or compromised server, or a MitM, can make the strings an application reads differ from the bytes the server returned (inappropriate encoding for the output context), which can defeat application-side validation or escaping built on those values. Exploitation requires control of the server side of the connection; no confidentiality or availability impact.
Credit
Reported by fg0x0
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.mariadb.jdbc:mariadb-java-client | ≥ 3.0.0&&< 3.3.7 | 3.3.7org.mariadb.jdbc:mariadb-java-client:3.3.7 |
| ☕Maven | org.mariadb.jdbc:mariadb-java-client | ≥ 3.4.0&&< 3.4.5 | 3.4.5org.mariadb.jdbc:mariadb-java-client:3.4.5 |
| ☕Maven | org.mariadb.jdbc:mariadb-java-client | ≥ 3.5.0&&< 3.5.11 | 3.5.11org.mariadb.jdbc:mariadb-java-client:3.5.11 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.mariadb.jdbc:mariadb-java-client, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.mariadb.jdbc:mariadb-java-client to 3.3.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-119281 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-119281 in your dependencies?
Find it across Maven, including transitive dependencies.