Most recent entries from all

bdu:2026-14966

BELL-CVE-2026-48165

Affected: Alpaquita:23: mariadb, Alpaquita:25: mariadb, Alpaquita:stream: mariadb

BIT-mariadb-2026-48165 — MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

Affected: Bitnami: mariadb

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

EUVD-2026-343632

fkie_cve-2026-48165

openSUSE-SU-2026:10934-1 — libmariadbd-devel-11.8.8-1.1 on GA media

libmariadbd-devel-11.8.8-1.1 on GA media

RHSA-2026:25143 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine mariadb: mbstream: Unauthorized file creation via path traversal mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries urllib3: urllib3: Denial of Service due to excessive HTTP response decompression mariadb: Arbitrary code execution via improper parameter validation during SST mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

RLSA-2026:33093 — Important: mariadb10.11 security, bug fix, and enhancement update

Affected: Rocky Linux:10: mariadb10.11

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22095-1 — Security update for mariadb

Security update for mariadb

UBUNTU-CVE-2026-48165

Affected: Ubuntu:16.04:LTS: mariadb-10.0, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3, Ubuntu:22.04:LTS: mariadb-10.6, Ubuntu:24.04:LTS: mariadb, Ubuntu:25.10: mariadb, Ubuntu:26.04:LTS: mariadb

WID-SEC-W-2026-1744 — MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.