CVE-2026-44172: MariaDB SQL Injection Vulnerability

CVE-2026-44172 Overview

CVE-2026-44172 is a SQL injection vulnerability [CWE-89] affecting the MariaDB Connector/C library in versions 3.3.18 and 3.4.8. The flaw resides in the mysql_real_escape_string() function, which fails to properly escape input when the connection uses the big5 character set with the text protocol. Applications relying on this function to sanitize user input remain exposed to SQL injection despite calling the documented escaping API. MariaDB patched the issue in versions 3.3.19 and 3.4.9.

Critical Impact
Attackers can bypass mysql_real_escape_string() sanitization to inject arbitrary SQL statements against applications connected with the big5 character set, compromising database integrity and confidentiality.

Affected Products

MariaDB Connector/C version 3.3.18
MariaDB Connector/C version 3.4.8
Applications using mysql_real_escape_string() with the big5 character set over the text protocol

Discovery Timeline

2026-06-12 - CVE-2026-44172 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44172

Vulnerability Analysis

The vulnerability stems from incorrect multi-byte character handling inside MariaDB Connector/C's escaping routine. When a client connection negotiates the big5 character set, certain byte sequences form valid multi-byte characters whose trailing byte can be the ASCII backslash (0x5C). The mysql_real_escape_string() function does not account for these sequences correctly, so attacker-controlled input can be crafted to consume the backslash that would otherwise escape a following quote character. The result is an unescaped single quote that breaks out of the SQL string literal context.

This class of flaw is well known in the MySQL/MariaDB ecosystem and has historically been mitigated by disabling NO_BACKSLASH_ESCAPES handling or switching to prepared statements. The reintroduction of the issue in the connector regressed protections that applications assumed were in place.

Root Cause

The mysql_real_escape_string() implementation in the affected versions does not correctly parse big5 multi-byte characters when generating an escaped output buffer. Specific input bytes are misclassified as single-byte ASCII, so a 0x5C byte that is actually the second half of a legitimate big5 character is treated as an escape introducer. Crafted input then leaves the following quote unescaped.

Attack Vector

Exploitation requires that the target application accept user-supplied input, pass it through mysql_real_escape_string(), and send the resulting query over the text protocol on a connection configured with the big5 character set. The attacker provides a string containing a specific big5 byte pair followed by a single quote and additional SQL. The escaping routine does not neutralize the quote, and the server parses the appended SQL as part of the original statement. No authentication to the database is required because the injection occurs in the application layer; the attacker only needs to reach an input field that feeds a vulnerable query path.

No public proof-of-concept code has been released. Refer to the MariaDB GitHub Security Advisory GHSA-pv9p-5w55-55jm and MariaDB JIRA Ticket CONC-819 for upstream technical details.

Detection Methods for CVE-2026-44172

Indicators of Compromise

Database query logs containing unexpected SQL clauses such as UNION SELECT, OR 1=1, or comment terminators originating from parameterized input fields
Application connections negotiating SET NAMES big5 or character_set_client=big5 followed by anomalous query patterns
Unexpected schema discovery queries against information_schema tables from application service accounts

Detection Strategies

Inventory MariaDB Connector/C deployments and flag any instance running 3.3.18 or 3.4.8
Enable MariaDB general query log or audit plugin and search for malformed string literals correlated with big5 sessions
Inspect application source for calls to mysql_real_escape_string() combined with manual string concatenation rather than parameterized queries

Monitoring Recommendations

Alert on database errors indicating syntax breaks (ER_PARSE_ERROR) from production application service accounts
Forward database audit logs and connector version telemetry into a centralized SIEM for longitudinal analysis
Monitor outbound query volumes per application user and trigger on sudden spikes that may indicate data exfiltration

How to Mitigate CVE-2026-44172

Immediate Actions Required

Upgrade MariaDB Connector/C to version 3.3.19 or 3.4.9 across all application servers
Audit application code for SQL construction patterns that rely on mysql_real_escape_string() and migrate to prepared statements with bound parameters
Restrict the database character set to utf8mb4 where business requirements do not mandate big5

Patch Information

MariaDB resolved the issue in Connector/C 3.3.19 and 3.4.9. The fix corrects multi-byte character handling inside the escaping routine. Upgrade instructions and patch notes are available in the MariaDB GitHub Security Advisory.

Workarounds

Switch affected applications to the binary protocol using server-side prepared statements, which do not rely on string escaping
Configure connections to use a character set other than big5, such as utf8mb4, until patching is complete
Add a web application firewall rule to reject input containing suspicious big5 byte sequences followed by quote characters on endpoints feeding database queries

bash

# Configuration example: enforce utf8mb4 on the client connection
# my.cnf (client section)
[client]
default-character-set = utf8mb4

[mysql]
default-character-set = utf8mb4