Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-44172: MariaDB server is a community developed fork of MySQL server

58
This month
CRITICAL 9.1REMOTEWATCHLISTDOWNGRADEMITIGATE

CVE-2026-44172 is a critical-severity flaw (CVSS 9.1) affecting mariadb, enterprise linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

Why this priority

  • Critical severity
  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score9.1 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance1.0% (top 36%)
CISA exploited listNo
WeaknessCWE-89
Published2026-06-12
Last modified2026-10-26
Publisher (CNA): GitHub, Inc. · Vendor: mariadb · redhat

Share: LinkedIn · X · Reddit

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

mariadb mariadb DOWNGRADE
Affected: 3.3.18 · 3.4.8
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.3.18
1. Check installed version
apt-cache policy mariadb || rpm -q mariadb || mariadb --version
2. No fixed release: DOWNGRADE to a release before 3.3.18 (Debian / Ubuntu)
apt-cache madison mariadb sudo apt install mariadb=<VERSION_BEFORE_3.3.18> sudo apt-mark hold mariadb
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mariadb sudo dnf downgrade mariadb-<VERSION_BEFORE_3.3.18> sudo dnf versionlock add mariadb
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat enterprise linux MITIGATE
Affected: 10.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · flare-im · FIXED · 0.22.7-1.fc46 · FEDORA-2026-cd5e8062a1 · source
sudo dnf upgrade --advisory=FEDORA-2026-cd5e8062a1
Fedora ELN · libdnf · FIXED · 0.76.0-2.eln159 · FEDORA-2026-dbd263e9d4 · source
sudo dnf upgrade --advisory=FEDORA-2026-dbd263e9d4
Debian 12 · mariadb · FIXED · 1:10.11.18-0+deb12u1
sudo apt update && sudo apt install --only-upgrade mariadb dpkg --compare-versions "$(dpkg-query -W -f='${Version}' mariadb)" ge "1:10.11.18-0+deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · mariadb · NO FIX YET
RHEL 10 · mariadb-connector-c · FIXED · mariadb-connector-c-3.4.4-2.el10_2
sudo dnf upgrade --advisory=RHSA-2026:43505 rpm -q mariadb-connector-c
RHEL 10.0 Extended Update Support · mariadb-connector-c · FIXED · mariadb-connector-c-3.4.4-1.el10_0.1
sudo dnf upgrade --advisory=RHSA-2026:47772 rpm -q mariadb-connector-c
RHEL 8 · mariadb-connector-c · FIXED · mariadb-connector-c-3.1.11-3.el8_10
sudo dnf upgrade --advisory=RHSA-2026:75674 rpm -q mariadb-connector-c
RHEL 8.4 Advanced Mission Critical Update Support · mariadb-connector-c · FIXED · mariadb-connector-c-3.1.11-2.el8_4.1
sudo dnf upgrade --advisory=RHSA-2026:83079 rpm -q mariadb-connector-c
RHEL 8.4 Extended Update Support Long-Life Add-On · mariadb-connector-c · FIXED · mariadb-connector-c-3.1.11-2.el8_4.1
sudo dnf upgrade --advisory=RHSA-2026:83079 rpm -q mariadb-connector-c
Alpine 3.20 · mariadb · FIXED · mariadb-10.11.17-r0
apk add --upgrade mariadb apk info -v mariadb
Alpine 3.21 · mariadb · FIXED · mariadb-11.4.11-r0
apk add --upgrade mariadb apk info -v mariadb
Alpine 3.22 · mariadb · FIXED · mariadb-11.4.11-r0
apk add --upgrade mariadb apk info -v mariadb
Alpine 3.23 · mariadb · FIXED · mariadb-11.4.11-r0
apk add --upgrade mariadb apk info -v mariadb
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-1873 · source
sudo dnf update --advisory=ALAS2023-2026-1873
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-44172?

mariadb: downgrade or apply the listed mitigation; enterprise linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-44172 being exploited?

CVE-2026-44172 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-44172 affect?

CVE-2026-44172 affects mariadb, enterprise linux. Severity is critical (CVSS 9.1). MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text proto

How urgent is CVE-2026-44172?

Priority 58/100. Critical severity; Remotely exploitable, no login, no user action; On your watchlist

Software pages

MySQL vulnerabilities · MariaDB vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.