Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

MariaDB Connector C may let attackers alter database queries

published 29 days ago

Summary

The MariaDB Connector C library, used by C and C++ programs to talk to MariaDB or MySQL databases, can mishandle certain character data and allow specially crafted input to change the intended SQL command. This could let an attacker read, change, or delete data. Update the connector to the latest version as soon as possible to close the gap.

What to do

Update rocky mariadb-connector-c to version 0:3.2.6-2.el9_8.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:9	rocky	mariadb-connector-c	< 0:3.2.6-2.el9_8 Fix: upgrade to 0:3.2.6-2.el9_8

Original advisory text

Important: mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.

Security Fix(es):

* mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:75673 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2488459 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:75673 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.1 Critical

Timeline

Published6 Oct 2026

Updated6 Oct 2026

First seen6 Oct 2026

Sources

RLSA-2026:75673 · OSV

Track software like this

Free during beta