Skip to content
OpenAdvisories
High ALAS2023-2026-1873 1 CVE

Important: mariadb-connector-c security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-44172: An application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2023 mariadb-connector-c 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-config 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-debuginfo 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-debugsource 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-devel 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-devel-debuginfo 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-doc 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-test 0:3.3.10-1.amzn2023.0.2
Amazon Linux · 2023 mariadb-connector-c-test-debuginfo 0:3.3.10-1.amzn2023.0.2

Vulnerabilities 1

  • Medium 6.9
    CVE-2026-44172

    MariaDB: mysql_real_escape_string() incorrectly handled big5

    MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 charac…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Alpine PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-44172.html