CVE-2026-119281

A flaw was found in MariaDB Connector/J. The database connector fails to properly validate changes to the result character set and incorrectly assumes all returned data is UTF-8 encoded. A malicious database server or an attacker intercepting network communication (a machine-in-the-middle attacker) can alter the character set without notification, causing database responses to decode into unexpected text strings. This discrepancy may allow an attacker to bypass application-side input validation, sanitization, or escaping mechanisms.

This vulnerability is rated as Moderate rather than Important because successful exploitation requires significant prerequisites, specifically compromised database infrastructure or active network interception between client applications and the database. In typical Red Hat deployments utilizing Java services connected to MariaDB or MySQL, client applications process query results under the assumption of UTF-8 encoding. An adversary controlling the server response can manipulate output character sets, creating discrepancies between raw bytes and parsed text that might bypass application-level sanitization without directly impacting system confidentiality or availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.