MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and se…
Critical CVSS 9.1
Summary
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://jira.mariadb.org/browse/CONC-819
Sources
- NVD DATABASE
Original Links
- https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm Mitigation
- https://jira.mariadb.org/browse/CONC-819 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30135 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-44172 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488459 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json Third Party Advisory
Timeline
- nvd_ingest NVD