RHSA-2026:49522 — Red Hat Security Advisory: mariadb10.11 security update

Fixed packages 27

Release	Package	Fixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-backup	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-backup-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-client-utils	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-common	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-devel	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-embedded	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-embedded-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-embedded-devel	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-errmsg	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-gssapi-server	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-gssapi-server-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-oqgraph-engine	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-oqgraph-engine-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-pam	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-pam-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-server	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-server-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-server-galera	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-server-utils	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-server-utils-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-test	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb-test-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb10.11	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb10.11-debuginfo	3:10.11.18-1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0	mariadb10.11-debugsource	3:10.11.18-1.el10_0

Vulnerabilities 12

Critical 10.0

CVE-2026-49261

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the nam…

MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Wolfi

Jun 11, 2026
High 8.0

CVE-2026-44168

MariaDB: wsrep SST unsafe parameter handling on the donor side

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the…

MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Alpine Wolfi

Jun 12, 2026
High 8.0

CVE-2026-48163

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the…

MariaDB server mariadb-10.3 mariadb-10.6 Debian Ubuntu Alpine Wolfi

Jun 12, 2026
High 8.0

CVE-2026-48165

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_add…

MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Alpine Wolfi

Jun 12, 2026
Medium 6.3

CVE-2026-44170

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST …

MariaDB server mariadb mariadb Ubuntu Alpine Wolfi

Jun 12, 2026
Medium 6.3

CVE-2026-44171

MariaDB: path traversal in mbstream

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the arc…

MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Alpine Wolfi

Jun 12, 2026
Medium 5.5

CVE-2025-30693

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server MySQL Cluster percona-server-5.6 Debian Ubuntu Azure Linux

Apr 15, 2025
Medium 5.3

CVE-2025-30722

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

Oracle MySQL Cluster MySQL Client percona-server-5.6 Debian Ubuntu

Apr 15, 2025
Medium 5.0

CVE-2026-44173

MariaDB: FILE privilege was not checked for subqueries in the FROM clause

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFI…

MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Alpine Wolfi

Jun 12, 2026
Medium 4.9

CVE-2023-52969

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes cr…

MariaDB MariaDB mariadb-10.6 mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2023-52970

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11…

MariaDB MariaDB mariadb-10.6 mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025
Medium 4.9

CVE-2023-52971

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

MariaDB MariaDB mariadb mariadb Debian Ubuntu Azure Linux Wolfi

Mar 8, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2487957
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488450
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488451
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488453
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488454
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488458
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488460
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49522.json
report
https://access.redhat.com/security/cve/CVE-2023-52969
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350916
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52969
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52969
article
https://jira.mariadb.org/browse/MDEV-32083
report
https://access.redhat.com/security/cve/CVE-2023-52970
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350918
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52970
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52970
article
https://jira.mariadb.org/browse/MDEV-32086
report
https://access.redhat.com/security/cve/CVE-2023-52971
report
https://bugzilla.redhat.com/show_bug.cgi?id=2350917
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52971
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52971
article
https://jira.mariadb.org/browse/MDEV-32084
report
https://access.redhat.com/security/cve/CVE-2025-30693
report
https://bugzilla.redhat.com/show_bug.cgi?id=2359963
advisory
https://www.cve.org/CVERecord?id=CVE-2025-30693
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30693
article
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2025-30722
report
https://bugzilla.redhat.com/show_bug.cgi?id=2359885
advisory
https://www.cve.org/CVERecord?id=CVE-2025-30722
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30722
report
https://access.redhat.com/security/cve/CVE-2026-44168
advisory
https://www.cve.org/CVERecord?id=CVE-2026-44168
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44168
article
https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h
article
https://jira.mariadb.org/browse/MDEV-39413
report
https://access.redhat.com/security/cve/CVE-2026-44170

Red Hat Security Advisory: mariadb10.11 security update

Fixed packages 27

Vulnerabilities 12

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB: wsrep SST unsafe parameter handling on the donor side

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB: path traversal in mbstream

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

MariaDB: FILE privilege was not checked for subqueries in the FROM clause

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes cr…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11…

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

References

Red Hat Security Advisory: mariadb10.11 security update

Fixed packages 27

Vulnerabilities 12

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB: wsrep SST unsafe parameter handling on the donor side

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB: path traversal in mbstream

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

MariaDB: FILE privilege was not checked for subqueries in the FROM clause

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes cr…

MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11…

MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.

References

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes cr…

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11…