MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From
    3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only
    changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on
    the server's global session_track_system_variables configuration to report character-set changes. A
    malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change
    the result charset so application strings differed from the returned bytes, potentially defeating
    application-side validation or escaping that depended on the decoded values. This issue is fixed in
    versions 3.3.7, 3.4.5, and 3.5.11. (CVE-2026-119281)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From     3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only     changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on     the server's global session_track_system_variables configuration to report character-set changes. A     malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change     the result charset so application strings differed from the returned bytes, potentially defeating     application-side validation or escaping that depended on the decoded values. This issue is fixed in     versions 3.3.7, 3.4.5, and 3.5.11. (CVE-2026-119281)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478128	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.1-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478128	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.1-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
478059	SCA: security update for org.mariadb.jdbc:mariadb-java-client (GHSA-grfq-r75j-rw9x)	Tenable Cloud Security	SCA Checks	Local	medium
478059	SCA: security update for org.mariadb.jdbc:mariadb-java-client (GHSA-grfq-r75j-rw9x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
374234	Linux Distros Unpatched Vulnerability : CVE-2026-119281	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-119281

medium

Tenable Plugins

medium

medium

medium

medium

medium