CVE-2026-44172: MariaDB: mysql_real_escape_string() incorrectly handled big5
Last updated 11 July 2026
Other sources
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysqlrealescapestring() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysqlrealescapestring() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mariadbto a version that resolves this vulnerability.Fixed in 1:10.11.18-0+deb12u1Fixed in 1:11.8.8-1 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 3.3.19 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 3.4.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44172?
CVE-2026-44172 has a risk rating of 66, indicating a medium severity level.
How do I fix CVE-2026-44172?
To mitigate CVE-2026-44172, ensure that user input is properly validated before passing it to mysql_real_escape_string() and consider upgrading to a non-vulnerable version of MariaDB.
Which versions of MariaDB are affected by CVE-2026-44172?
CVE-2026-44172 affects MariaDB versions 3.3.18 and 3.4.8.
What type of vulnerability is CVE-2026-44172?
CVE-2026-44172 is classified as an SQL Injection vulnerability.
How can I detect if my application is vulnerable to CVE-2026-44172?
You can detect CVE-2026-44172 by reviewing your application's database interactions with non-validated user input and checking if it uses mysql_real_escape_string() in the context of the affected MariaDB versions.