CVE-2026-44172

Description

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

How to fix CVE-2026-44172

To remediate CVE-2026-44172, upgrade the affected package to a fixed version below.

• —upgrade to 10.11.17-r0 or later
• —upgrade to 10.4.34 or later
• —upgrade to 10.6.23 or later
• —upgrade to 10.6.17 or later
• —no fix listed
• —no fix listed

Is CVE-2026-44172 being exploited?

No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2026-44172.

Affected packages (6)

• from 0, < 10.11.17-r0
• >= 3.3.18, < 10.4.34
• >= 3.3.18, < 10.6.23
• >= 3.3.18, < 10.6.17
• from 0
• from 0, <= 3.3.18, <= 3.4.8

CVSS scores

References (5)

• ADVISORYgithub.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm
• ADVISORYjira.mariadb.org/browse/CONC-819
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-44172
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-44172
• WEB