A security flaw has been identified in two specific versions of MariaDB, a popular open-source database software used by many websites to store data such as user information, site content, and order records. The affected versions are 3.3.18 and 3.4.8.
Normally, developers use a standard tool called mysql_real_escape_string() to block SQL injection attacks, a common type of hack that lets unauthorized users access, modify, or delete a website’s stored database data. But in these specific MariaDB versions, that protection stops working under certain conditions: when the database is configured to use the big5 character set and communicates via text protocol. This means even if your site uses the usual input sanitization method, it could be vulnerable to these attacks if it accepts unvetted user input, such as from contact forms, comment boxes, login fields, or search bars.
The flaw has already been addressed in patched MariaDB versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
