Critical SQL Injection Vulnerability in MariaDB Connector/C
Summary
ALSA-2026:43505: Important: mariadb-connector-c security update. Affects mariadb-connector-c versions < 3.4.4-2.el10_2. Fixed in 3.4.4-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB Connector/C is a native client library that enables applications developed in C/C++ to connect to MariaDB and MySQL databases. It provides essential functionalities for database interactions, including executing queries and managing connections. However, it has been identified that improper handling of the big5 character set can lead to SQL injection vulnerabilities, posing significant security risks to applications relying on this library.
Vulnerability Detail
The vulnerability arises from the improper handling of the big5 character set within the mysql_real_escape_string() function. This flaw allows attackers to exploit SQL injection, potentially leading to unauthorized access to sensitive data, data manipulation, or even complete system compromise. The vulnerability has been assigned CVE-2026-44172, indicating its severity and the need for immediate remediation.
How To Fix
Minimum fixed version
3.4.4-2.el10_2
This is the first release that contains the fix.
sudo dnf update mariadb-connector-cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider sanitizing user inputs and avoiding the use of the big5 character set until the update is applied. Implementing additional validation checks on SQL queries can also help mitigate the risk of SQL injection.
Conclusion
The identified SQL injection vulnerability in MariaDB Connector/C poses a significant risk to applications using this library. It is crucial to update to the patched version to mitigate potential threats. Users are encouraged to implement workarounds and utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for mariadb-connector-c →
FAQ
The SQL injection vulnerability can lead to unauthorized access to sensitive data, data manipulation, and potential system compromise.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, implement input validation and avoid using the big5 character set as a temporary workaround.
More information can be found on the CVE page for CVE-2026-44172, which details the vulnerability and its implications.
Yes, Vulert is a reliable tool that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb-connector-c.
