False Positiv on CVE-2026-44170

[No Data]

There is a false positive for this CVE-2026-44170. The Module Streams are affected, but the default version is not affected. However, it is reported as affected because it is being compared against the Module Stream version using a “condition less than” comparison.

This affects all packages related to this CVE.

https://cti.wazuh.com/vulnerabilities/cves/CVE-2026-44170?affected%5Bvendor%5D=Red+Hat&affected%5Bplatform%5D=RHEL+9

vulnerability.scanner.condition : package less than 3:10.11.18-1.module+el9.8.0+24388+85f1c439

Version on Server:

mariadb-server-3:10.5.29-3.el9_7.x86_64

Module: (none)

[No Data]

oh sorry its on redhat 9

[Alejandro Ruiz Becerra]

Hi!

I'm elevating this internally to the team. I'll be back with a response as soon as possible.

Regards,

Alex

[Alejandro Ruiz Becerra]

Hi again!

Can you check if the reported package is installed in your system? The path should be present in the `package.path` field.

If the package is present, the report is valid, as per RHSA-2026:33482 - Security Advisory.

[No Data]

Sorry for the late response. I don't understand the question. The output above is from the server, and of course the package is installed. The MariaDB server is running, after all.

[Alejandro Ruiz Becerra]

Hi again!

We could check this internally and confirmed this is a false positive. The corresponding team is working on it.

Thank you.