STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

DISA Rule

SV-253666r960735_rule

Vulnerability Number

V-253666

Group Title

SRG-APP-000001-DB-000031

Rule Version

MADB-10-000100

Severity

CAT III

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

To limit the number of connections allowed by a specific user, as a user with appropriate privileges, run the following SQL:

MariaDB> GRANT USAGE ON *.* TO 'username'@'host' WITH MAX_USER_CONNECTIONS number_of_connections;

Check Contents

To check the number of connections allowed for each user, as the database administrator, run the following SQL:

MariaDB> SELECT user, max_user_connections FROM mysql.user;

If any users have more connections configured than documented, this is a finding. A value of 0 indicates unlimited and is a finding.

Vulnerability Number

V-253666

Documentable

False

Rule Version

MADB-10-000100

Severity Override Guidance

To check the number of connections allowed for each user, as the database administrator, run the following SQL:

MariaDB> SELECT user, max_user_connections FROM mysql.user;

If any users have more connections configured than documented, this is a finding. A value of 0 indicates unlimited and is a finding.

Check Content Reference

M

Target Key

5475