A security flaw has been found in MariaDB, the widely used open-source database software many websites rely on to store user data, site content, and other information. The issue impacts MariaDB versions 3.3.18 and 3.4.8.
Normally, websites use a standard security tool called mysql_real_escape_string to block SQL injection attacks, which happen when malicious input submitted through web forms, search bars, or other user-facing features is used to run unauthorized commands on a database. However, for sites running the affected MariaDB versions that use the big5 character set and text protocol to send data to the database, attackers could bypass this standard protection. This could let bad actors access, change, or delete data stored in your website’s database without authorization.
The MariaDB development team has released patched versions 3.3.19 and 3.4.9 that resolve this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172