Summary
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.
Security Fix(es):
* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)
* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)
* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | mariadb11.8 | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-backup | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-client-utils | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-common | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-devel | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-embedded | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-embedded-devel | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-errmsg | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-gssapi-server | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-oqgraph-engine | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-pam | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-server | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-server-galera | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-server-utils | 3:11.8.8-2.el10_2.alma.2 |
| AlmaLinux · 10 | mariadb11.8-test | 3:11.8.8-2.el10_2.alma.2 |
Vulnerabilities 3
-
High 8.2
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursi…
-
High 7.6
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of…
-
High 7.4
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrec…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-103111
-
report
https://access.redhat.com/security/cve/CVE-2026-86145
-
report
https://access.redhat.com/security/cve/CVE-2026-89161
-
report
https://bugzilla.redhat.com/2528993
-
report
https://bugzilla.redhat.com/2531747
-
report
https://bugzilla.redhat.com/2543797
-
advisory
https://errata.almalinux.org/10/ALSA-2026-84799.html