{"id":"CVE-2026-44172","summary":"MariaDB: mysql_real_escape_string() incorrectly handled big5","details":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.","aliases":["BIT-mariadb-2026-44172","BIT-mariadb-min-2026-44172","BIT-mysql-client-2026-44172","GHSA-pv9p-5w55-55jm","PYSEC-2026-217"],"modified":"2026-10-22T02:47:58.149137827Z","published":"2026-06-12T17:34:04.487Z","related":["ALSA-2026:43505","ALSA-2026:75673","ALSA-2026:75674","SUSE-SU-2026:22095-1","SUSE-SU-2026:2282-1","SUSE-SU-2026:2284-1","SUSE-SU-2026:22844-1","SUSE-SU-2026:2330-1","SUSE-SU-2026:3110-1","SUSE-SU-2026:3134-1","SUSE-SU-2026:3135-1","openSUSE-SU-2026:10897-1","openSUSE-SU-2026:11721-1","openSUSE-SU-2026:20933-1","openSUSE-SU-2026:21409-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"= 3.3.18"},{"last_affected":"= 3.3.18"},{"introduced":"= 3.4.8"},{"last_affected":"= 3.4.8"}]}]},{"extracted_events":[{"range":[{"fixed":"3.3.19"}],"source":"DESCRIPTION"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44172.json"},"references":[{"type":"WEB","url":"https://jira.mariadb.org/browse/CONC-819"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30135"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43505"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47772"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:68567"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-44172"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44172.json"},{"type":"ADVISORY","url":"https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488459"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"776555af021e917ce0d6235386b43ae59fdd5161"},{"last_affected":"776555af021e917ce0d6235386b43ae59fdd5161"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","range":[{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING"}]}}],"versions":["10.0","mariadb-10.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44172.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}