CVE-2025-59681·MariaDB vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.58% — higher than 44% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2025-59681 scores 7.1 on CVSS, so a successful attack would be serious — but at 0.58%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

MariaDB users running versions 5.2.0 through 5.2.6 must upgrade to 5.2.7 or later to patch a SQL injection vulnerability in query alias handling. This vulnerability allows authenticated users to inject malicious SQL through crafted dictionary arguments passed to QuerySet methods on MySQL and MariaDB backends. Immediate patching is recommended for production environments, especially those with untrusted database users or applications that construct dynamic queries.

sudo dnf update mariadb-server

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement input validation to restrict dictionary keys passed to Django ORM methods to alphanumeric characters and underscores only; block requests containing suspicious alias patterns with special characters, semicolons, or SQL keywords in column alias parameters.

How to check if you are affected

1. Step 1: Check installed MariaDB version by running `mariadb --version` or connecting to the server and executing `SELECT VERSION();`
2. Step 2: Verify if your application uses Django ORM with annotate(), alias(), aggregate(), or extra() methods that accept user-controlled dictionary arguments
3. Step 3: Search MariaDB audit logs for suspicious SQL patterns containing unusual alias definitions or multiple consecutive column aliases with special characters: `grep -i 'alias' /var/log/mysql/audit.log | grep -E '["\'].*[;\-\-]'`
4. Step 4: After patching, confirm the new version by running `mariadb --version` and verify query execution with a test annotate() call returns expected results without errors

FAQ

Related MariaDB CVEs

References

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
• http://www.openwall.com/lists/oss-security/2025/10/01/3