Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-44172

MariaDB: mysql_real_escape_string() incorrectly handled big5

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-44172

Published

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-44172

Published

server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MariaDB",
                    "product": "server",
                    "versions": [
                        {
                            "version": "= 3.3.18",
                            "status": "affected"
                        },
                        {
                            "version": "= 3.4.8",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON