Critical SQL Injection Vulnerability in MariaDB Connector/C: CVE-2026-44172
Summary
RLSA-2026:43505: Important: mariadb-connector-c security update. Affects mariadb-connector-c versions < 0:3.4.4-2.el10_2. Fixed in 0:3.4.4-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB Connector/C is a native client library that enables applications developed in C/C++ to connect to MariaDB and MySQL databases. It provides essential functionalities for database interaction, such as executing queries and managing connections. However, it has been identified to have a critical SQL injection vulnerability that arises from improper handling of the big5 character set, which can lead to unauthorized data access or manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2026-44172, is an SQL injection flaw that occurs when the mysql_real_escape_string() function fails to properly handle inputs encoded in the big5 character set. This oversight allows attackers to inject malicious SQL statements, potentially compromising the integrity and confidentiality of the database. The ramifications of this vulnerability can be severe, including unauthorized data access, data corruption, and complete system compromise.
How To Fix
Minimum fixed version
0:3.4.4-2.el10_2
This is the first release that contains the fix.
sudo dnf update mariadb-connector-cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider sanitizing inputs manually before passing them to the mysql_real_escape_string() function. This can help mitigate the risk of SQL injection until the package can be updated. For example, you can implement input validation to restrict the character set allowed in user inputs.
Conclusion
The MariaDB Connector/C has a critical SQL injection vulnerability that needs immediate attention. Updating to the patched version is essential to secure your applications against potential attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for mariadb-connector-c →
FAQ
CVE-2026-44172 is a critical SQL injection vulnerability in the MariaDB Connector/C that arises from improper handling of the big5 character set.
Exploitation of this vulnerability can lead to unauthorized access to your database, data corruption, and potential system compromise.
Update the MariaDB Connector/C package to the latest patched version using 'sudo yum update mariadb-connector-c'.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for CVE-2026-44172 is 9.1, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb-connector-c.
