RHSA-2026:0247 — Red Hat Security Advisory: mariadb:10.11 security update

Fixed packages 27

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	galera	0:26.4.20-1.module+el9.5.0+22578+dc54e53f
Red Hat · RHEL 9 enterprise_linux:9::appstream	galera-debuginfo	0:26.4.20-1.module+el9.5.0+22578+dc54e53f
Red Hat · RHEL 9 enterprise_linux:9::appstream	galera-debugsource	0:26.4.20-1.module+el9.5.0+22578+dc54e53f
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-backup	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-backup-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-common	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-debugsource	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-devel	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-embedded	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-embedded-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-embedded-devel	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-errmsg	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-gssapi-server	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-gssapi-server-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-oqgraph-engine	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-oqgraph-engine-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-pam	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-pam-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-server	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-server-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-server-galera	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-server-utils	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-server-utils-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-test	3:10.11.15-1.module+el9.7.0+23768+0a6844e9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mariadb-test-debuginfo	3:10.11.15-1.module+el9.7.0+23768+0a6844e9

Vulnerabilities 8

High 7.0

CVE-2025-13699

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit t…

MariaDB MariaDB mariadb-10.3 mariadb-10.0 Debian Ubuntu Azure Linux

Dec 23, 2025
Medium 6.5

CVE-2026-21968

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Azure Linux

Jan 20, 2026
Medium 5.5

CVE-2025-30693

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Azure Linux

Apr 15, 2025
Medium 5.3

CVE-2025-30722

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

Oracle MySQL Cluster MySQL Client percona-server-5.6 Debian Ubuntu

Apr 15, 2025
Medium 4.9

CVE-2023-52969

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes cr…

MariaDB MariaDB mariadb-10.6 mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2023-52970

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11…

MariaDB MariaDB mariadb-10.6 mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2023-52971

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

MariaDB MariaDB mariadb mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2025-21490

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Azure Linux Alpine Wolfi

Jan 21, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2339221
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350916
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350917
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350918
report
https://bugzilla.redhat.com/show_bug.cgi?id=2359885
report
https://bugzilla.redhat.com/show_bug.cgi?id=2359963
report
https://bugzilla.redhat.com/show_bug.cgi?id=2417693
article
https://issues.redhat.com/browse/RHEL-125855
article
https://issues.redhat.com/browse/RHEL-130867
article
https://issues.redhat.com/browse/RHEL-130870
article
https://issues.redhat.com/browse/RHEL-132454
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0247.json
report
https://access.redhat.com/security/cve/CVE-2023-52969
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52969
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52969
article
https://jira.mariadb.org/browse/MDEV-32083
report
https://access.redhat.com/security/cve/CVE-2023-52970
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52970
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52970
article
https://jira.mariadb.org/browse/MDEV-32086
report
https://access.redhat.com/security/cve/CVE-2023-52971
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52971
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52971
article
https://jira.mariadb.org/browse/MDEV-32084
report
https://access.redhat.com/security/cve/CVE-2025-13699
advisory
https://www.cve.org/CVERecord?id=CVE-2025-13699
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-13699
report
https://access.redhat.com/security/cve/CVE-2025-21490
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21490
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21490
article
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2025-30693
advisory
https://www.cve.org/CVERecord?id=CVE-2025-30693
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30693
article
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2025-30722
advisory
https://www.cve.org/CVERecord?id=CVE-2025-30722
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30722

Red Hat Security Advisory: mariadb:10.11 security update

Fixed packages 27

Vulnerabilities 8

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes cr…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11…

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

References

Red Hat Security Advisory: mariadb:10.11 security update

Fixed packages 27

Vulnerabilities 8

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes cr…

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11…

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

References

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes cr…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11…