A security flaw has been identified in specific older versions of MariaDB, a popular community-developed fork of the MySQL database system that many websites rely on to store and manage content, user information, and other site data.
In affected versions 3.3.18 and 3.4.8, a standard built-in safety function designed to block SQL injection attacks fails to work as intended under specific conditions. SQL injection is a common attack technique where bad actors manipulate database queries to access, modify, or delete stored site data. The safety function, called mysql_real_escape_string(), is normally used to process unvalidated user input (like form entries or search terms) to prevent these attacks. But if the site sends data to the database using the text protocol with the big5 character set enabled, the function does not provide the expected protection, even when used correctly by developers.
The vulnerability has been patched in updated MariaDB versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
