CVE-2026-44172: Mariadb SQL injection (CVSS 9.1)

Description

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Mariadb3.3.18 · 3.4.8

Redhat Enterprise Linux10.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm

References

https://access.redhat.com/errata/RHSA-2026:30135Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:43505
https://access.redhat.com/errata/RHSA-2026:47772
https://access.redhat.com/errata/RHSA-2026:68567
https://access.redhat.com/security/cve/CVE-2026-44172Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2488459Third Party Advisory
https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jmMitigationVendor Advisory
https://jira.mariadb.org/browse/CONC-819Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.jsonThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-44172 being actively exploited?

CVE-2026-44172 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.04%.

How severe is CVE-2026-44172?

CVE-2026-44172 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 1.04% probability of exploitation.

Which products are affected by CVE-2026-44172?

Affected products include Mariadb, Redhat Enterprise Linux.

How do I fix CVE-2026-44172?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-44172 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo