CVE-2023-52971: mariadb Insecure Automated Optimizations
CVSS: 4.9v3.1MediumDeferred
AliasesUBUNTU-CVE-2023-52971DEBIAN-CVE-2023-52971CGA-42wg-wh92-m6fmCGA-5v7p-vfgg-f48wCGA-6q4w-5pgc-q58mCGA-7f35-7mj6-2798CGA-945g-54c3-r66gCGA-9wfj-w42w-q7r6CGA-c86q-5j9x-q2x6CGA-ffr8-3jff-8jrwCGA-frvj-r9hv-qc43CGA-j492-3v9f-h7q7CGA-q2hw-p92g-j6fhCGA-q647-xh9w-fchcCGA-vh3f-x7c4-fgrqCGA-vph9-hgfq-mw9jCGA-xjv5-3j5g-w478
Published 08-03-2025Last modified 12-05-2025
Vulnerability summary
CVE-2023-52971 is a medium (CVSS 4.9) Insecure Automated Optimizations vulnerability in mariadb. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities.
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.50%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 3Timeline
- 08-03-2025PublishedVulnerability first disclosed.
- 12-05-2025Last modifiedVulnerability information updated.
Description
MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 4.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.01 pp
From 0.49% on 19-09-2026
19-09-202619-10-2026
EPSS score0.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- mariadb-10.11< 10.11.14-r0
- mariadb-10.11-embedded< 10.11.19-r2
- mariadb-11.2All versions (No fix recorded)
- mariadb-11.4< 11.4.8-r0
- mariadb-11.5All versions (No fix recorded)
Wolfi8 products
- mariadb-10.11< 10.11.14-r0
- mariadb-10.11-embedded< 10.11.19-r2
- mariadb-11.2All versions (No fix recorded)
- mariadb-11.4< 11.4.8-r0
- mariadb-11.5All versions (No fix recorded)
Debian1 product
- mariadb< 1:10.11.13-0+deb12u1 | < 1:11.8.2-1
Mariadb1 product
- mariadb≥ 10.10, < 10.11.* | ≥ 11.0, < 11.4.*
Ubuntu1 product
- mariadb< 1:10.11.13-0ubuntu0.24.04.1
5 vendors · 19 products
