MariaDB

MariaDB 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 内存破坏23
• 拒绝服务7
• 访问控制6
• SQL 注入4
• 密码学缺陷4
• 其他弱点3
• 信息泄露3
• 注入与走私3
• 路径遍历3
• 服务端请求伪造1
• 身份认证1
• 跨站请求伪造1
• 业务逻辑1
• 代码执行1

主要弱点

• 资源消耗失控7
• 栈溢出6
• 越界读6
• SQL 注入4
• 访问控制缺陷（通用）4
• 密码学问题（通用）3
• 路径遍历3
• CRLF 注入3
• Unlabeled3
• 释放后使用3

常见资产

• MariaDB Server & Connectors - Denial of ServiceSOURCE_CODE · 15
• mariadb.orgURL · 14
• MariaDB Server & Connectors - Data corruption, exfiltration, disclosureSOURCE_CODE · 14
• MariaDB Server & Connectors - Access control bypassSOURCE_CODE · 8
• MariaDB Server & Connectors - Remote Code ExecutionSOURCE_CODE · 7
• · 3

高票报告

当前状态 59 份 · 全部 61

1. 73
   Grafana LFI on https://grafana.mariadb.org代码执行 · 2022-01-07 · 中危
   $0远程文件包含
2. 51
   Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client内存破坏 · 2026-09-08 · 严重
   $0栈溢出
3. 43
   Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking内存破坏 · 2026-09-08 · 高危
   $0越界读
4. 35
   MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover访问控制 · 2026-09-08 · 高危
   $0访问控制缺陷（通用）
5. 31
   Connector/C Out-of-bounds read in `unpack_fields()` from short metadata field内存破坏 · 2026-09-30 · 未评级
   $0越界读
6. 31
   Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket拒绝服务 · 2026-09-30 · 中危
   $0资源消耗失控
7. 29
   Path Traversal in mbstream Extract路径遍历 · 2026-10-03 · 高危
   $0路径遍历
8. 23
   MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server Crash拒绝服务 · 2026-10-08 · 中危
   $0资源消耗失控
9. 23
   Stack Buffer-Overflow in MariaDB Charset_collation_map_st::insert_or_replace()内存破坏 · 2026-09-15 · 未评级
   $0栈溢出
10. 23
    libmariadb ( mariadb-connector-c ): stack overflow via server-controlled field->length in prepared-statement codec内存破坏 · 2026-10-04 · 中危
    $0栈溢出
11. 21
    SSRF on jira.mariadb.org服务端请求伪造 · 2018-10-13 · 中危
    $0SSRF
12. 20
    scripts loader (denial of service) vulnerability拒绝服务 · 2020-03-19 · 低危
    $0资源消耗失控
13. 19
    DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalation访问控制 · 2026-10-08 · 高危
    $0访问控制缺陷（通用）
14. 18
    Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser内存破坏 · 2026-10-11 · 中危
    $0Unlabeled
15. 18
    Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server内存破坏 · 2026-09-04 · 中危
    $0栈溢出
16. 16
    Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables内存破坏 · 2026-10-13 · 未评级
    $0栈溢出
17. 16
    MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service拒绝服务 · 2026-10-08 · 中危
    $0资源消耗失控
18. 16
    Heap Memory Disclosure via Integer Underflow in Item_func_json_arrayagg::cut_max_length in MariaDB Server内存破坏 · 2026-09-15 · 未评级
    $0缓冲区越界读
19. 16
    CRLF injection at https://mariadb.org/.注入与走私 · 2019-02-21 · 中危
    $0CRLF 注入
20. 16
    Vulnerability Report - Missing Certificate Authority Authorization rule密码学缺陷 · 2018-11-12 · 低危
    $0密码学问题（通用）
21. 14
    Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read内存破坏 · 2026-10-08 · 严重
    $0释放后使用
22. 14
    Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write访问控制 · 2026-10-08 · 高危
    $0访问控制缺陷（通用）
23. 14
    Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP内存破坏 · 2026-10-08 · 中危
    $0Integer Underflow
24. 12
    Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failure密码学缺陷 · 2026-11-05 · 未评级
    $0证书校验不当
25. 12
    Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB Server内存破坏 · 2026-09-15 · 未评级
    $0释放后使用