CVE-2026-119281: 
Java vulnerability analysis and mitigation

CVE-2026-119281 is a character set encoding vulnerability in MariaDB Connector/J (the Java JDBC driver for MariaDB and MySQL databases) that allows a malicious or compromised server, or a machine-in-the-middle (MitM) attacker, to silently switch the result character set away from UTF-8 without the client detecting the change. Affected versions span from 3.0.0 through 3.3.6, 3.4.0 through 3.4.4, and 3.5.0 through 3.5.10. The vulnerability was reported by researcher fg0x0, published on October 29, 2026, and patched versions were released around October 21–30, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-838 (Inappropriate Encoding for Output Context): the connector assumed all query result bytes were UTF-8 and guarded against changes to character_set_client, but failed to monitor or reject changes to character_set_results. Additionally, the connector relied on the server's global session_track_system_variables configuration to be notified of character set changes — meaning a server configured (or manipulated) to omit those variables from tracking could silently alter the result encoding. The fix introduces an explicit, client-controlled session tracking list that always includes both character_set_client and character_set_results, and closes the connection if character_set_results is changed to any non-UTF-8 charset (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to cause Java applications to misinterpret database result strings — the bytes returned by the server are encoded in one charset while the application decodes them as UTF-8, producing different string values. This mismatch can defeat application-side input validation, escaping logic, or SQL injection protections that depend on correctly decoded string values, resulting in a high integrity impact. There is no confidentiality or availability impact; exploitation requires control of the server side of the connection (via a compromised/malicious database server or a MitM network position) (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). Exploitation requires a high-complexity attack — the attacker must control or compromise the database server, or occupy a MitM position on the network connection between the Java application and the database. No threat actor attribution is available. The EPSS score is approximately 0.0028 (0.28%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain server-side control: The attacker must either compromise the target MariaDB/MySQL server, operate a rogue server that the Java application connects to, or position themselves as a MitM on the network path between the Java application and the database server.
2. Suppress charset tracking: Configure the server's session_track_system_variables global setting to exclude character_set_results (e.g., set it to an empty string or a list that omits charset variables), preventing the connector from being notified of charset changes.
3. Switch the result charset: Issue or inject a SET character_set_results = latin1 (or another non-UTF-8 charset) command within the session, either directly on a compromised server or by injecting it into the protocol stream as a MitM.
4. Return crafted data: Serve database query results encoded in the non-UTF-8 charset (e.g., latin1). The vulnerable connector decodes these bytes as UTF-8, producing different string values in the Java application.
5. Bypass application validation: The application's input validation or SQL escaping logic operates on the incorrectly decoded strings, potentially allowing injection payloads or malicious values to pass through undetected (GitHub Advisory, Patch Commit).

• Network: Unexpected SET character_set_results commands observed in database session traffic; database connections not using TLS/SSL where MitM interception is feasible.
• Logs: Database server logs showing SET character_set_results to a non-UTF-8 charset (e.g., latin1, latin2) during application sessions; changes to the global session_track_system_variables that remove charset variables from tracking.
• Application Behavior: Java application exceptions or unexpected string decoding errors related to character encoding; application-side validation failures or anomalous data passing through input filters that should have been rejected.

Upgrade MariaDB Connector/J to one of the patched versions: 3.3.7, 3.4.5, or 3.5.11. The fix ensures the connector sets an explicit, client-controlled session_track_system_variables list (independent of the server's global configuration) and closes the connection if character_set_results is changed to a non-UTF-8 charset. As a network-level workaround, enforce TLS/SSL for all database connections to prevent MitM attacks, and restrict database server access to trusted hosts only. Additional application-level validation that does not rely solely on character encoding assumptions can reduce risk for applications that cannot immediately upgrade (GitHub Advisory, Release 3.3.7).