A security flaw has been identified in two specific versions of MariaDB, a popular open-source database software used by many websites to store content, user accounts, and other site data. The affected versions are 3.3.18 and 3.4.8.
The issue creates an unexpected gap in protection against SQL injection attacks, a common type of cyber threat where bad actors can manipulate database queries to access, change, or delete sensitive information on your site. This flaw impacts sites that accept unvalidated user input, use the standard mysql_real_escape_string() security tool designed to block these attacks, connect to the database via text protocol, and use the big5 character set: even when the security tool is used correctly, it will fail to protect against this specific vulnerability.
The MariaDB team has released a patch for this issue, with fixes included in updated versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172