CVE-2025-59681·MariaDB vulnerability

Affected versions

How to fix this CVE

MariaDB users running versions 5.2.0 through 5.2.6 must upgrade to 5.2.7 or later to patch a SQL injection vulnerability in query alias handling. This vulnerability allows authenticated users to inject malicious SQL through crafted dictionary arguments passed to QuerySet methods on MySQL and MariaDB backends. Immediate patching is recommended for production environments, especially those with untrusted database users or applications that construct dynamic queries.

sudo dnf update mariadb-server

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement input validation to restrict dictionary keys passed to Django ORM methods to alphanumeric characters and underscores only; block requests containing suspicious alias patterns with special characters, semicolons, or SQL keywords in column alias parameters.

How to check if you are affected

1. Step 1: Check installed MariaDB version by running `mariadb --version` or connecting to the server and executing `SELECT VERSION();`
2. Step 2: Verify if your application uses Django ORM with annotate(), alias(), aggregate(), or extra() methods that accept user-controlled dictionary arguments
3. Step 3: Search MariaDB audit logs for suspicious SQL patterns containing unusual alias definitions or multiple consecutive column aliases with special characters: `grep -i 'alias' /var/log/mysql/audit.log | grep -E '["\'].*[;\-\-]'`
4. Step 4: After patching, confirm the new version by running `mariadb --version` and verify query execution with a test annotate() call returns expected results without errors

FAQ

Related MariaDB CVEs

References

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
• http://www.openwall.com/lists/oss-security/2025/10/01/3