Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5

Critical 9.1

In plain English

A critical-severity SQL injection in server from MariaDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.0%top 35.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10mariadb-connector-c3.4.4-2.el10_2ALSA-2026:43505
AlmaLinux:8mariadb-connector-c3.1.11-3.el8_10ALSA-2026:75674
AlmaLinux:9mariadb-connector-c3.2.6-2.el9_8ALSA-2026:75673
AlmaLinux:10mariadb-connector-c-config3.4.4-2.el10_2ALSA-2026:43505
AlmaLinux:8mariadb-connector-c-config3.1.11-3.el8_10ALSA-2026:75674
AlmaLinux:9mariadb-connector-c-config3.2.6-2.el9_8ALSA-2026:75673
AlmaLinux:10mariadb-connector-c-devel3.4.4-2.el10_2ALSA-2026:43505
AlmaLinux:8mariadb-connector-c-devel3.1.11-3.el8_10ALSA-2026:75674
AlmaLinux:9mariadb-connector-c-devel3.2.6-2.el9_8ALSA-2026:75673
AlmaLinux:10mariadb-connector-c-doc3.4.4-2.el10_2ALSA-2026:43505
AlmaLinux:9mariadb-connector-c-doc3.2.6-2.el9_8ALSA-2026:75673
AlmaLinux:10mariadb-connector-c-test3.4.4-2.el10_2ALSA-2026:43505
AlmaLinux:9mariadb-connector-c-test3.2.6-2.el9_8ALSA-2026:75673
Alpine:v3.20mariadb10.11.17-r0ALPINE-CVE-2026-44172
Alpine:v3.21mariadb11.4.11-r0ALPINE-CVE-2026-44172
Alpine:v3.22mariadb11.4.11-r0ALPINE-CVE-2026-44172
Alpine:v3.23mariadb11.4.11-r0ALPINE-CVE-2026-44172
Alpine:v3.24mariadb11.8.7-r0ALPINE-CVE-2026-44172
Debian:12mariadb1:10.11.18-0+deb12u1DEBIAN-CVE-2026-44172
Debian:13mariadbno fix listedDEBIAN-CVE-2026-44172
Debian:14mariadb1:11.8.8-1DEBIAN-CVE-2026-44172
PyPImariadbno fix listedPYSEC-2026-217
Rocky Linux:10galera0:26.4.27-1.el10_2RLSA-2026:33412
Rocky Linux:9galera0:26.4.27-1.module+el9.8.0+40229+87be66a2RLSA-2026:33482
Rocky Linux:9galera0:26.4.27-1.module+el9.8.0+40229+87be66a2RLSA-2026:33481
Rocky Linux:9galera0:26.4.27-1.module+el9.8.0+40232+a354f53aRLSA-2026:33481
Rocky Linux:9galera0:26.4.27-1.module+el9.8.0+40232+a354f53aRLSA-2026:33482
Rocky Linux:9mariadb3:10.11.18-1.module+el9.8.0+40232+a354f53aRLSA-2026:33482
Rocky Linux:9mariadb3:11.8.8-1.module+el9.8.0+40229+87be66a2RLSA-2026:33481
Rocky Linux:10mariadb-connector-c0:3.4.4-2.el10_2RLSA-2026:43505
Rocky Linux:8mariadb-connector-c0:3.1.11-3.el8_10RLSA-2026:75674
Rocky Linux:9mariadb-connector-c0:3.2.6-2.el9_8RLSA-2026:75673
Rocky Linux:10mariadb10.113:10.11.18-1.el10_2RLSA-2026:33093
Ubuntu:24.04:LTSmariadbno fix listedUBUNTU-CVE-2026-44172
Ubuntu:25.10mariadbno fix listedUBUNTU-CVE-2026-44172
Ubuntu:26.04:LTSmariadb1:11.8.6-5ubuntu0.1UBUNTU-CVE-2026-44172
Ubuntu:22.04:LTSmariadb-10.6no fix listedUBUNTU-CVE-2026-44172

Affected products (as reported)

VendorProductVersions
MariaDB server = 3.3.18= 3.4.8

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References