Most recent entries from all

ALSA-2026:33093 — Important: mariadb10.11 security, bug fix, and enhancement update

Affected: AlmaLinux:10: mariadb, AlmaLinux:10: mariadb-backup, AlmaLinux:10: mariadb-client-utils, AlmaLinux:10: mariadb-common, AlmaLinux:10: mariadb-devel, AlmaLinux:10: mariadb-embedded, AlmaLinux:10: mariadb-embedded-devel, AlmaLinux:10: mariadb-errmsg, AlmaLinux:10: mariadb-gssapi-server, AlmaLinux:10: mariadb-oqgraph-engine and 5 more

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-14967

BELL-CVE-2026-49261

Affected: Alpaquita:23: mariadb, Alpaquita:25: mariadb, Alpaquita:stream: mariadb

BIT-mariadb-2026-49261 — MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Affected: Bitnami: mariadb

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

EUVD-2026-351375

fkie_cve-2026-49261

OESA-2026-2732 — mariadb security update

Affected: openEuler:24.03-LTS-SP3: mariadb

openSUSE-SU-2026:10934-1 — libmariadbd-devel-11.8.8-1.1 on GA media

libmariadbd-devel-11.8.8-1.1 on GA media

RHSA-2026:25143 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine mariadb: mbstream: Unauthorized file creation via path traversal mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries urllib3: urllib3: Denial of Service due to excessive HTTP response decompression mariadb: Arbitrary code execution via improper parameter validation during SST mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

RLSA-2026:33093 — Important: mariadb10.11 security, bug fix, and enhancement update

Affected: Rocky Linux:10: mariadb10.11

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22095-1 — Security update for mariadb

Security update for mariadb

UBUNTU-CVE-2026-49261

Affected: Ubuntu:16.04:LTS: mariadb-10.0, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3, Ubuntu:22.04:LTS: mariadb-10.6, Ubuntu:24.04:LTS: mariadb, Ubuntu:25.10: mariadb, Ubuntu:26.04:LTS: mariadb

WID-SEC-W-2026-1744 — MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.