CVE-2026-44172

Name	CVE-2026-44172
Description	MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb (PTS)	bookworm	1:10.11.14-0+deb12u2	vulnerable
	trixie	1:11.8.6-0+deb13u1	vulnerable
	forky	1:11.8.6-6	vulnerable
	sid	1:11.8.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mariadb	source	(unstable)	1:11.8.8-1

Notes

[trixie] - mariadb <no-dsa> (Will be fixed via point release)
https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm
https://jira.mariadb.org/browse/CONC-819