https://blog.kalfaoglu.net/tags/sql-injection/Recent content in Sql-Injection on kalfaoglu.netHugoenTue, 13 Oct 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-10-13-dovecot-cve-2026-40018-mysql-injection-en/Tue, 13 Oct 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-10-13-dovecot-cve-2026-40018-mysql-injection-en/<p>Dovecot&rsquo;s security page quietly listed a new high-severity advisory on August 28, 2026. The major Linux distributions took about six weeks to ship patched packages, and Red Hat&rsquo;s advisory for RHEL 10 landed on <a href="https://vulners.com/redhat/RHSA-2026:79371-CVE-2026-40018">October 8, 2026</a>. If you run Dovecot against a MySQL or MariaDB backend and haven&rsquo;t updated recently, read on.</p> <h2 id="what-the-bug-is">What the Bug Is</h2> <p><a href="https://app.opencve.io/cve/CVE-2026-40018">CVE-2026-40018</a> is an SQL injection flaw (CWE-89) in Dovecot&rsquo;s MySQL driver. The escaping function that sanitizes SQL query parameters falls back to a charset-unaware escape call when the SQL connection drops and reconnects under specific multi-byte character sequences. An attacker who can supply crafted input at the right moment — say, through a malformed username or password string — can break out of the expected SQL context and either read sensitive data or modify it.</p>