CVE-2026-119281

Overview

MariaDB Connector/J is MariaDB's JDBC driver: a JDBC 4.2 compatible driver used to connect applications developed in Java to MariaDB and MySQL databases. It is published to Maven Central as org.mariadb.jdbc:mariadb-java-client, and Spring Boot 2.7.18 manages its 3.1.4 release.

A content spoofing vulnerability (CVE-2026-119281) has been identified in the session state handling of MariaDB Connector/J, which allows a malicious or compromised database server, or a machine-in-the-middle attacker, to change the character set of query results without the driver noticing. The driver keeps decoding every result as UTF-8, so the strings an application reads can differ from the bytes the server returned, which can defeat application-side validation or escaping built on those values.

Per OWASP: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application.

This issue affects multiple versions of MariaDB Connector/J.

Details

Module Info

• Product: MariaDB Connector/J
• Affected packages: org.mariadb.jdbc:mariadb-java-client
• Affected versions: >=3.0.0 <3.3.7, >=3.4.0 <3.4.5, >=3.5.0 <3.5.11
• GitHub repository: https://github.com/mariadb-corporation/mariadb-connector-j
• Published packages: https://central.sonatype.com/artifact/org.mariadb.jdbc/mariadb-java-client
• Package manager: Maven
• Fixed in:
  • OSS MariaDB Connector/J 3.3.7, 3.4.5, 3.5.11
  • NES for MariaDB Connector/J v3.1.7

Vulnerability Info

This Medium-severity vulnerability is found in the org.mariadb.jdbc:mariadb-java-client package in multiple versions of MariaDB Connector/J. The driver assumes the server sends every string in UTF-8 and decodes result bytes with a fixed charset, regardless of the session's character_set_results:

public String readString(int length) {
  pos += length;
  return new String(buf, pos - length, length, StandardCharsets.UTF_8);
}

The driver learns about session variable changes only through the session tracking information the server attaches to OK packets. In affected versions a change of character_set_results is not acted on. In the 3.1.x line, the OkPacket handler for tracked system variables only logs the change:

case StateChange.SESSION_TRACK_SYSTEM_VARIABLES:
  buf.readIntLengthEncodedNotNull();
  String variable = buf.readString(buf.readIntLengthEncodedNotNull());
  Integer len = buf.readLength();
  String value = len == null ? null : buf.readString(len);
  logger.debug("System variable change:  {} = {}", variable, value);
  break;

Releases that do guard character_set_client against a switch away from UTF-8 still accept any value for character_set_results. The driver also never sets its own session_track_system_variables list, so it depends on the server's global setting to be told about character set changes at all. A server that is configured, or made, not to track those variables can change them silently.

An attacker who controls the server side of the connection, either a malicious or compromised server or a machine-in-the-middle attacker, can therefore switch character_set_results to a charset other than UTF-8. Every result that follows is encoded in that charset but decoded by the driver as UTF-8, so the String values returned through ResultSet no longer match what the server stored. Applications that validate, escape or compare those values can be made to act on content that differs from what they checked.

Mitigation

MariaDB plc's Engineering Policy lists MariaDB Connector/J 2.7, 3.3, 3.4 and 3.5 as its supported release series. Upstream has made no 3.1.x release since 3.1.4 (April 2023), so no 3.1.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of MariaDB Connector/J that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• fg0x0 (finder)