MariaDB

A raw TCP protocol, not HTTP — address is host or host:port, no scheme. Port defaults to 3306 when omitted. Same handshake as MySQL: MariaDB announces its version unprompted in the initial handshake packet, before any authentication step, so this probe never needs a credential.

targets:
  - id: mariadb-main
    product: mariadb
    address: db.example.com:3306

Authentication

None — the version is read straight out of the handshake. Since 2.2.1 the probe then answers the greeting with a throwaway login, so the connection no longer counts towards max_connect_errors — see MySQL → Host blocking.

Vendor identity check

MariaDB and MySQL speak the identical handshake and differ only in the version string, which comes in two shapes, both confirmed live:

• MariaDB 10.x masks its version behind a 5.5.5- compatibility prefix for old MySQL clients: 5.5.5-10.11.19-MariaDB-ubu2204. The mask is stripped.
• MariaDB 11.0+ dropped the mask: 11.4.13-MariaDB-ubu2404, 12.3.3-MariaDB-ubu2404. The -MariaDB in the version is then the only signal. Recognised since 2.1.1 — 2.1.0 refused these servers.

Either shape is accepted. Pointed at a real MySQL server, whose version has neither, the probe fails rather than recording a wrong fact, the mirror image of mysql refusing a MariaDB server.

Recorded fields

• version — the numeric version, e.g. 10.11.19
• extra.tag — the vendor tag after it, e.g. MariaDB-ubu2204, when present

CVE correlation

Matched against NVD and БДУ ФСТЭК when a cve: block is configured — and, with cve.mariadb.path, against MariaDB’s own table of fixed CVEs, whose per-series verdict wins over БДУ’s and NVD’s open-ended ranges. See Vendors’ own data → MariaDB.

Lifecycle resolver

endoflife:mariadb.