CVE-2026-44172

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
MariaDB	server	= 3.3.18; = 3.4.8
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—

References

https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jmMitigation, Vendor Advisory
https://jira.mariadb.org/browse/CONC-819Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30135Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:43505
https://access.redhat.com/errata/RHSA-2026:47772
https://access.redhat.com/errata/RHSA-2026:68567
https://access.redhat.com/security/cve/CVE-2026-44172Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2488459Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.jsonThird Party Advisory

Timeline

Published: Jun 12, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-441735.3MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to CVE-2026-441748.7Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in i CVE-2026-441758.5Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the CVE-2026-441766.0Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page CVE-2026-441778.8Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the prov CVE-2026-441788.8xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel f CVE-2026-441799.9XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `exc CVE-2026-44185.4IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML cod CVE-2026-441809.8Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Sw CVE-2026-4418110.0Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Sw CVE-2026-4418210.0Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Sw CVE-2026-441839.8Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorr