CVE-2026-119281
Description
A flaw was found in MariaDB Connector/J. The database connector fails to properly validate changes to the result character set and incorrectly assumes all returned data is UTF-8 encoded. A malicious database server or an attacker intercepting network communication (a machine-in-the-middle attacker) can alter the character set without notification, causing database responses to decode into unexpected text strings. This discrepancy may allow an attacker to bypass application-side input validation, sanitization, or escaping mechanisms.
Statement
This vulnerability is rated as Moderate rather than Important because successful exploitation requires significant prerequisites, specifically compromised database infrastructure or active network interception between client applications and the database. In typical Red Hat deployments utilizing Java services connected to MariaDB or MySQL, client applications process query results under the assumption of UTF-8 encoding. An adversary controlling the server response can manipulate output character sets, creating discrepancies between raw bytes and parsed text that might bypass application-level sanitization without directly impacting system confidentiality or availability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component. When the wrong encoding is used - even if closely related - the downstream component could decode the data incorrectly and misinterpret the output. This can have security consequences when the provided boundaries between control and data are inadvertently broken, because the resulting data could introduce control characters or special elements that were not sent by the product. The resulting data could then be used to bypass protection mechanisms such as input validation, and enable injection attacks.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
