EUVD-2026-36513Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitTrigger uncharacterized MariaDB defect
-
ImpactAchieve unconfirmed impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions cannot be determined from available data. No CVSS vector is present to indicate whether this requires network access, local access, authentication, or user interaction. No description details a specific configuration, feature flag, protocol, or deployment mode that must be present. The vulnerability type (CWE) is undisclosed. Security teams cannot assess whether default Alpine Linux MariaDB deployments are at risk or whether only specific configurations are vulnerable - this is a critical gap that must be resolved by consulting the upstream advisory before making risk decisions. |
| Impact | Risk cannot be meaningfully quantified from available data. No CVSS score or vector is present, making it impossible to assess attack vector, complexity, required privileges, or scope. No EPSS score is available to estimate exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. The only signal is a vendor-issued fix from Alpine Linux, which confirms a real security defect was present. Without CVSS, CWE, or a detailed description, this could range from a critical remote code execution to a low-severity local information disclosure - that distinction is entirely unconfirmed. Security teams should consult the upstream MariaDB and Alpine Linux security advisories directly before assigning priority. |
| Exploit ScenarioDerived | An attack scenario cannot be constructed from available data - the vulnerability type, affected component within MariaDB, required access level, and exploitable condition are all unknown. No proof-of-concept code has been identified. Until the Alpine Linux or MariaDB project publishes a detailed advisory, the realistic attack path remains uncharacterized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
MariaDB on Alpine Linux contains an uncharacterized vulnerability addressed in Alpine package version 11.8.7-r0. The nature, impact class, and exploitability of this vulnerability cannot be determined from available data - no CVSS score, vector, CWE classification, or detailed description has been published. The sole confirmed fact is that the Alpine Linux vendor issued a patched package, indicating a security-relevant defect existed in prior MariaDB builds shipped with Alpine. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.
RemediationAI
Upgrade the Alpine Linux MariaDB package to version 11.8.7-r0 or later using 'apk upgrade mariadb'. This is the vendor-confirmed fixed version per the Alpine Linux security report. No workarounds or compensating controls are documented in available data, as the vulnerability type is unknown - generic controls cannot be responsibly recommended without knowing the attack surface. If immediate patching is not feasible, consider restricting MariaDB network exposure (bind to localhost or internal interfaces only) as a general precaution, understanding this only reduces network-based attack surface and may not mitigate local or application-layer exploitation vectors. Consult the Alpine Linux packages tracker and MariaDB changelogs for additional remediation context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MariaDB is an open-source relational database management system derived from MySQL, widely used in server deployments. Alpine Linux packages MariaDB using its own versioning scheme, where '11.8.7-r0' denotes MariaDB upstream release 11.8.7 packaged as Alpine package revision 0. The underlying vulnerability class (CWE) is not disclosed in available data - it is unknown whether this is a memory safety issue, an authentication bypass, a SQL injection surface, a privilege escalation, or another class of defect. No CPE string or affected version range beyond the implicit 'versions prior to 11.8.7 in Alpine' was provided.
Know when MariaDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
2DescriptionCVE.org
Alpine Linux: mariadb fixed in 11.8.7-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Exploit-DB