Read the docs
TI-2026-32152 Aliases CVE-2026-44172

MariaDB: mysql_real_escape_string() incorrectly handled big5

Priority LOW 38CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-89.

Summary

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01041 64th percentileScored 2026-11-07
Fix Fixed Red Hat: 25 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MariaDBserver= 3.3.18; = 3.4.8—No fix listedCNA
  • server VendorMariaDB Affected = 3.3.18; = 3.4.8 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mariadb:mariadb:3.3.18:*:*:*:*:*:*:*3.3.18VulnerableMariaDB
cpe:2.3:a:mariadb:mariadb:3.4.8:*:*:*:*:*:*:*3.4.8VulnerableMariaDB
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
  • cpe:2.3:a:mariadb:mariadb:3.3.18:*:*:*:*:*:*:* Versions 3.3.18 Vulnerable ·MariaDB
  • cpe:2.3:a:mariadb:mariadb:3.4.8:*:*:*:*:*:*:* Versions 3.4.8 Vulnerable ·MariaDB
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat

Remediation

Red Hat 25 advisories

  • RHSA-2026:94469 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:94468 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.7 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:94461 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
Show 22 more Red Hat advisories
  • RHSA-2026:94455 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:91248 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:91245 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:91244 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:91241 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:91235 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:91234 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:91233 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:91218 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:91217 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:83608 Released 2026-10-15 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) mariadb-connector-c-3.2.6-1.el9_2.1, mariadb-connector-c-config-3.2.6-1.el9_2.1, mariadb-connector-c-devel-3.2.6-1.el9_2.1
  • RHSA-2026:83517 Released 2026-10-15 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) mariadb-connector-c-3.1.11-2.el8_6.1, mariadb-connector-c-config-3.1.11-2.el8_6.1, mariadb-connector-c-devel-3.1.11-2.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) mariadb-connector-c-3.1.11-2.el8_6.1, mariadb-connector-c-config-3.1.11-2.el8_6.1, mariadb-connector-c-devel-3.1.11-2.el8_6.1
  • RHSA-2026:83519 Released 2026-10-15 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) mariadb-connector-c-doc-3.2.6-1.el9_6.1, mariadb-connector-c-test-3.2.6-1.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) mariadb-connector-c-3.2.6-1.el9_6.1, mariadb-connector-c-config-3.2.6-1.el9_6.1, mariadb-connector-c-devel-3.2.6-1.el9_6.1
  • RHSA-2026:83518 Released 2026-10-15 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) mariadb-connector-c-3.2.6-1.el9_4.1, mariadb-connector-c-config-3.2.6-1.el9_4.1, mariadb-connector-c-devel-3.2.6-1.el9_4.1
  • RHSA-2026:83080 Released 2026-10-14 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) mariadb-connector-c-3.1.11-2.el8_8.1, mariadb-connector-c-config-3.1.11-2.el8_8.1, mariadb-connector-c-devel-3.1.11-2.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) mariadb-connector-c-3.1.11-2.el8_8.1, mariadb-connector-c-config-3.1.11-2.el8_8.1, mariadb-connector-c-devel-3.1.11-2.el8_8.1
  • RHSA-2026:83079 Released 2026-10-14 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) mariadb-connector-c-3.1.11-2.el8_4.1, mariadb-connector-c-config-3.1.11-2.el8_4.1, mariadb-connector-c-devel-3.1.11-2.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) mariadb-connector-c-3.1.11-2.el8_4.1, mariadb-connector-c-config-3.1.11-2.el8_4.1, mariadb-connector-c-devel-3.1.11-2.el8_4.1
  • RHSA-2026:75673 Released 2026-10-05 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream (v. 9) mariadb-connector-c-3.2.6-2.el9_8, mariadb-connector-c-config-3.2.6-2.el9_8, mariadb-connector-c-devel-3.2.6-2.el9_8
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) mariadb-connector-c-doc-3.2.6-2.el9_8, mariadb-connector-c-test-3.2.6-2.el9_8
  • RHSA-2026:75674 Released 2026-10-05 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream (v. 8) mariadb-connector-c-3.1.11-3.el8_10, mariadb-connector-c-config-3.1.11-3.el8_10, mariadb-connector-c-devel-3.1.11-3.el8_10
  • RHSA-2026:68567 Released 2026-09-17 · Red Hat rating Critical
    RHELAI 3.6: mariadb-connector-c 3.4.9 CVE-2026-44172
    • Red Hat Enterprise Linux AI 3.6 for RHEL 9 mariadb-connector-c-3.4.9-1.el9ai, mariadb-connector-c-config-3.4.9-1.el9ai, mariadb-connector-c-devel-3.4.9-1.el9ai +2
  • RHSA-2026:47772 Released 2026-07-29 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) mariadb-connector-c-devel-3.4.4-1.el10_0.1
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) mariadb-connector-c-3.4.4-1.el10_0.1, mariadb-connector-c-config-3.4.4-1.el10_0.1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) mariadb-connector-c-doc-3.4.4-1.el10_0.1, mariadb-connector-c-test-3.4.4-1.el10_0.1
  • RHSA-2026:43505 Released 2026-07-22 · Red Hat rating Important
    mariadb-connector-c security update
    • Red Hat Enterprise Linux AppStream (v. 10) mariadb-connector-c-devel-3.4.4-2.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) mariadb-connector-c-3.4.4-2.el10_2, mariadb-connector-c-config-3.4.4-2.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) mariadb-connector-c-doc-3.4.4-2.el10_2, mariadb-connector-c-test-3.4.4-2.el10_2
  • RHSA-2026:30135 Released 2026-06-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb-connector-c-3.4.9-1.hum1@aarch64, mariadb-connector-c-3.4.9-1.hum1@src, mariadb-connector-c-3.4.9-1.hum1@x86_64 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:83519
Red Hat Enterprise Linux AI 3.6 for RHEL 9Fixed RHSA-2026:68567
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:43505
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:75674
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:75673
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:83079
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:83517
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:83080
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:83608
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:83518
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:47772
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:83519
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:83079
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:83517
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:83080
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:43505
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:47772
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:43505
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:75673
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:47772
Red Hat Hardened ImagesFixed RHSA-2026:30135
Red Hat OpenShift AI 3.4Fixed RHSA-2026:91217, RHSA-2026:91218, RHSA-2026:91233, RHSA-2026:91234, RHSA-2026:91235, RHSA-2026:91241, RHSA-2026:91244, RHSA-2026:91245, RHSA-2026:91248, RHSA-2026:94455, RHSA-2026:94461, RHSA-2026:94468, RHSA-2026:94469
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44172
  2. 2026-10-05 Fix available: RHSA-2026:75674 · Red Hat
  3. 2026-10-05 Fix available: RHSA-2026:75673 · Red Hat
  4. 2026-10-05 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83517 · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83079 · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83608 · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83080 · Red Hat
  9. 2026-10-16 Fix available: RHSA-2026:83518 · Red Hat
  10. 2026-10-16 Fix available: RHSA-2026:83519 · Red Hat
  11. 2026-10-16 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream AUS (v.8.6) +7 · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:91217 · Red Hat
  13. 2026-10-30 Fix available: RHSA-2026:91233 · Red Hat
  14. 2026-10-30 Fix available: RHSA-2026:91218 · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:91235 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:91234 · Red Hat
  17. 2026-10-30 Fix available: RHSA-2026:91241 · Red Hat
  18. 2026-10-30 Fix available: RHSA-2026:91245 · Red Hat
  19. 2026-10-30 Fix available: RHSA-2026:91244 · Red Hat
  20. 2026-10-30 Fix available: RHSA-2026:91248 · Red Hat
  21. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  22. 2026-11-03 Fix available: RHSA-2026:94455 · Red Hat
  23. 2026-11-03 Fix available: RHSA-2026:94468 · Red Hat
  24. 2026-11-03 Fix available: RHSA-2026:94469 · Red Hat
  25. 2026-11-03 Fix available: RHSA-2026:94461 · Red Hat
  26. 2026-11-03 Affected versions changed · Red Hat

References

Advisory 6

  • TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
  • TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
See all 429 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences