Home

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-03 | Updated 2026-03-03 | Assigner AMZN




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-778 (Insufficient Logging)

Product status

Default status
unaffected

10.6.25
unaffected

10.11.16
unaffected

11.4.10
unaffected

11.8.6
unaffected

Default status
unaffected

2.12.6
unaffected

3.04.6
unaffected

3.10.3
unaffected

3.11.1
unaffected

Default status
unaffected

5.7.44-RDS.20260212
unaffected

8.0.45
unaffected

8.4.8
unaffected

Default status
unaffected

10.6.25
unaffected

10.11.16
unaffected

11.4.10
unaffected

11.8.6
unaffected

References

aws.amazon.com/security/security-bulletins/2026-006-AWS/ vendor-advisory

cve.org (CVE-2026-3494)

nvd.nist.gov (CVE-2026-3494)

Download JSON