4.3
Medium
CVE-2026-3494 In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable…
Description
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MariaDB Server 11.8 | earliest → < 11.8.6 | 11.8.6 |
| MariaDB Server 11.4 | earliest → < 11.4.10 | 11.4.10 |
| MariaDB Server 10.11 | earliest → < 10.11.16 | 10.11.16 |
| MariaDB Server 10.6 | earliest → < 10.6.25 | 10.6.25 |
| Aurora MySQL 3.11 | earliest → < 3.11.1 | 3.11.1 |
| Aurora MySQL 3.10 | earliest → < 3.10.3 | 3.10.3 |
| Aurora MySQL 3.04 | earliest → < 3.04.6 | 3.04.6 |
| Aurora MySQL 2.12 | earliest → < 2.12.6 | 2.12.6 |
| RDS for MySQL 8.4 | earliest → < 8.4.8 | 8.4.8 |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| RDS for MySQL 8.0 | earliest → < 8.0.45 | 8.0.45 |
| RDS for MySQL 5.7 | earliest → < 5.7.44-RDS.20260212 | 5.7.44-RDS.20260212 |
| RDS for MariaDB 11.8 | earliest → < 11.8.6 | 11.8.6 |
| RDS for MariaDB 11.4 | earliest → < 11.4.10 | 11.4.10 |
| RDS for MariaDB 10.11 | earliest → < 10.11.16 | 10.11.16 |
| RDS for MariaDB 10.6 | earliest → < 10.6.25 | 10.6.25 |