MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.9 · mariadb-corporationNVD modified 2026-10-29 20:58
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x x_refsource_confirm
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5 x_refsource_misc
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11 x_refsource_misc