Skip to content
OpenAdvisories
High ALAS2023-2026-3310 20 CVEs

Important: mariadb118 security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Nov 11, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97380: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. CVE-2026-92262: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. CVE-2026-86047: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. CVE-2026-85985: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. CVE-2026-85746: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. CVE-2026-85745: A flaw was found in MariaDB. An authenticated database user can exploit an out-of-bounds read vulnerability by supplying a specially crafted spatial geometry to the ST_Area function. This issue allows reading beyond allocated memory buffers, leading to unauthorized information disclosure of internal process memory. An attacker could use this disclosed data to facilitate further attacks, such as bypassing security protections like Address Space Layout Randomization (ASLR). CVE-2026-61081: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). CVE-2026-60747: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2026-60585: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). CVE-2026-60331: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve

Fixed packages 28

ReleasePackageFixed in
Amazon Linux · 2023 mariadb118 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-backup 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-backup-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-client-utils 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-common 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-connect-engine 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-connect-engine-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-cracklib-password-check 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-cracklib-password-check-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-debugsource 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-devel 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-errmsg 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-gssapi-server 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-gssapi-server-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-oqgraph-engine 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-oqgraph-engine-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-pam 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-pam-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-rocksdb-engine 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-rocksdb-engine-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-server 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-server-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-server-utils 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-sphinx-engine 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-sphinx-engine-debuginfo 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-test 3:11.8.9-1.amzn2023.0.1
Amazon Linux · 2023 mariadb118-test-debuginfo 3:11.8.9-1.amzn2023.0.1

Vulnerabilities 20

  • Critical 9.9
    CVE-2026-85746

    MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive W…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Critical 9.9
    CVE-2026-92262 Public exploit

    MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encod…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 8.8
    CVE-2026-97380

    MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, c…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Azure Linux
  • High 8.5
    CVE-2026-107815

    MariaDB: one byte OOB write in DOS tables of the CONNECT engine

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack bu…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 8.0
    CVE-2026-102523

    MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION

    MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in files…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 8.0
    CVE-2026-107821 Public exploit

    MariaDB: insufficient validation of binary frm data when opening a table

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM fi…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 7.7
    CVE-2026-86047

    MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers an…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 7.2
    CVE-2026-107823

    MariaDB: privilege escalation via incorrect view frm parsing

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER an…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Medium 6.6
    CVE-2026-60585

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-47064

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported vers…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Ubuntu
  • Medium 6.4
    CVE-2026-107816

    MariaDB: `qc_info` plugin can do OOB reads if query contains \0

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Medium 6.4
    CVE-2026-107822

    MariaDB: database privilege escalation via user / role name collision in the acl cache

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched bec…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Medium 6.4
    CVE-2026-60331

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Alpine
  • Medium 6.2
    CVE-2026-60747

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Alpine
  • Medium 5.4
    CVE-2026-85985

    MariaDB: Unauthorized file access via CONNECT engine UDFs

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affect…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Medium 4.9
    CVE-2026-47023

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Alpine
  • Medium 4.4
    CVE-2026-107817

    MariaDB: mysql_json plugin OOB reads

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Medium 4.4
    CVE-2026-60184

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2026-85745

    MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser a…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Low 2.7
    CVE-2026-61081

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Suppo…

    Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-102523.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-107815.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-107816.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-107817.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-107821.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-107822.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-107823.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47023.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47064.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-60184.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-60331.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-60585.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-60747.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-61081.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-85745.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-85746.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-85985.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-86047.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92262.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-97380.html