RHSA-2026:0334 — Red Hat Security Advisory: mariadb:10.11 security update

Fixed packages 27

Release	Package	Fixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	galera	0:26.4.20-1.module+el9.5.0+22578+dc54e53f
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	galera-debuginfo	0:26.4.20-1.module+el9.5.0+22578+dc54e53f
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	galera-debugsource	0:26.4.20-1.module+el9.5.0+22578+dc54e53f
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-backup	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-backup-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-common	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-debugsource	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-devel	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-embedded	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-embedded-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-embedded-devel	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-errmsg	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-gssapi-server	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-gssapi-server-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-oqgraph-engine	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-oqgraph-engine-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-pam	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-pam-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-server	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-server-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-server-galera	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-server-utils	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-server-utils-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-test	3:10.11.15-1.module+el9.6.0+23803+16eaad56
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	mariadb-test-debuginfo	3:10.11.15-1.module+el9.6.0+23803+16eaad56

Vulnerabilities 8

High 7.0

CVE-2025-13699

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit t…

MariaDB MariaDB mariadb-10.3 mariadb-10.0 Debian Ubuntu Azure Linux

Dec 23, 2025
Medium 6.5

CVE-2026-21968

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Azure Linux

Jan 20, 2026
Medium 5.5

CVE-2025-30693

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Azure Linux

Apr 15, 2025
Medium 5.3

CVE-2025-30722

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

Oracle MySQL Cluster MySQL Client percona-server-5.6 Debian Ubuntu

Apr 15, 2025
Medium 4.9

CVE-2023-52969

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes cr…

MariaDB MariaDB mariadb-10.6 mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2023-52970

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11…

MariaDB MariaDB mariadb-10.6 mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2023-52971

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

MariaDB MariaDB mariadb mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2025-21490

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Azure Linux Alpine Wolfi

Jan 21, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2417693
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0334.json
report
https://access.redhat.com/security/cve/CVE-2023-52969
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350916
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52969
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52969
article
https://jira.mariadb.org/browse/MDEV-32083
report
https://access.redhat.com/security/cve/CVE-2023-52970
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350918
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52970
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52970
article
https://jira.mariadb.org/browse/MDEV-32086
report
https://access.redhat.com/security/cve/CVE-2023-52971
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350917
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52971
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52971
article
https://jira.mariadb.org/browse/MDEV-32084
report
https://access.redhat.com/security/cve/CVE-2025-13699
advisory
https://www.cve.org/CVERecord?id=CVE-2025-13699
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-13699
report
https://access.redhat.com/security/cve/CVE-2025-21490
report
https://bugzilla.redhat.com/show_bug.cgi?id=2339221
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21490
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21490
article
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2025-30693
report
https://bugzilla.redhat.com/show_bug.cgi?id=2359963
advisory
https://www.cve.org/CVERecord?id=CVE-2025-30693
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30693
article
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2025-30722
report
https://bugzilla.redhat.com/show_bug.cgi?id=2359885
advisory
https://www.cve.org/CVERecord?id=CVE-2025-30722
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30722
report
https://access.redhat.com/security/cve/CVE-2026-21968
report
https://bugzilla.redhat.com/show_bug.cgi?id=2431409
advisory
https://www.cve.org/CVERecord?id=CVE-2026-21968
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-21968

Red Hat Security Advisory: mariadb:10.11 security update

Fixed packages 27

Vulnerabilities 8

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes cr…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11…

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

References

Red Hat Security Advisory: mariadb:10.11 security update

Fixed packages 27

Vulnerabilities 8

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes cr…

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11…

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

References

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes cr…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11…