MariaDB
Databases · products/mariadb.yaml · RSS
Latest 13.1.1 Sep 14, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 13.0 | 13.0.2 | Sep 15, 2026 | Dec 31, 2026 · maintained |
| 12.3 LTS | 12.3.3 | May 28, 2026 | Jun 12, 2029 · maintained |
| 12.2 | 12.2.2 | Feb 13, 2026 | May 28, 2026 · ended |
| 12.1 | 12.1.2 | Nov 18, 2025 | Feb 13, 2026 · ended |
| 12.0 | 12.0.2 | Aug 7, 2025 | Nov 18, 2025 · ended |
| 11.8 LTS | 11.8.9 | Jun 4, 2025 | Jun 4, 2028 · maintained |
| 11.7 | 11.7.2 | Feb 12, 2025 | May 12, 2025 · ended |
| 11.6 | 11.6.2 | Nov 13, 2024 | Feb 13, 2025 · ended |
| 11.5 | 11.5.2 | Aug 14, 2024 | Nov 21, 2024 · ended |
| 11.4 LTS | 11.4.13 | May 29, 2024 | May 29, 2029 · maintained |
| 11.3 | 11.3.2 | Feb 16, 2024 | May 29, 2024 · ended |
| 11.2 | 11.2.6 | Nov 21, 2023 | Nov 21, 2024 · ended |
| 11.1 | 11.1.6 | Aug 21, 2023 | Aug 21, 2024 · ended |
| 11.0 | 11.0.6 | Jun 6, 2023 | Jun 6, 2024 · ended |
| 10.11 LTS | 10.11.19 | Feb 16, 2023 | Feb 16, 2028 · maintained |
| 10.10 | 10.10.7 | Nov 7, 2022 | Nov 17, 2023 · ended |
| 10.9 | 10.9.8 | Aug 15, 2022 | Aug 22, 2023 · ended |
| 10.8 | 10.8.8 | May 20, 2022 | May 20, 2023 · ended |
| 10.7 | 10.7.8 | Feb 8, 2022 | Feb 9, 2023 · ended |
| 10.6 LTS | 10.6.28 | Jul 6, 2021 | Jul 6, 2026 · ended |
| 10.5 LTS | 10.5.29 | Jun 24, 2020 | Jun 24, 2025 · ended |
| 10.4 LTS | 10.4.34 | Jun 18, 2019 | Jun 18, 2024 · ended |
| 10.3 | 10.3.39 | May 25, 2018 | May 25, 2023 · ended |
| 10.2 | 10.2.44 | May 23, 2017 | May 23, 2022 · ended |
| 10.1 | 10.1.48 | Oct 17, 2015 | Oct 17, 2020 · ended |
| 10.0 | 10.0.38 | Mar 31, 2014 | Mar 31, 2019 · ended |
| 5.5 LTS | 5.5.68 | Apr 11, 2012 | Apr 11, 2020 · ended |
| 5.3 | 5.3.12 | Feb 29, 2012 | Mar 1, 2017 · ended |
| 5.2 | 5.2.14 | Nov 10, 2010 | Nov 10, 2015 · ended |
| 5.1 | 5.1.67 | Feb 1, 2010 | Feb 1, 2015 · ended |
Recent releases
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityCVE-2026-47064 (CVSS base score (v3.1): 6.5)
securityCVE-2026-44173 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44172 (CVSS base score (v3.1): 5.0)
breakingThe Galera package dependency has been removed from server packages and the Galera package is no longer included in the MariaDB repositories (MDEV-38744)
securityFixes CVE-2026-35549: An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user…
breakingRemove depth limit of 32 from JSON functions (MDEV-32854)
securityFixes for the following security vulnerabilities:
breakingRemove depth limit of 32 from JSON functions (MDEV-32854)
securityFixes for the following security vulnerabilities:
securityCVE-2026-21968
breakingGalera-26.4.23 corrects an incompatibility with OpenZFS >= 2.3.0 enabling the use of galera on this filesystem.
breakingRemove the error codes added to 10.11 by the MDEV-36032 patch (MDEV-36856)
breakingSLES 15 SP6 and SLES 15 SP7 are new packages in this release. Because of incompatibilities of packages between SLES service pack versions there are now separate packages for 15sp6 and 15sp7. An upgradeable repo file should include "sles/$releasever/$basearch" rather than the "sles15-amd64" or…
securitySupport for passphrase protected keys (MDEV-14091)
securityNew SET SESSION AUTHORIZATION (MDEV-20299)
securityImplement SHA2 support for file_key_management.so plugin (TDE) (MDEV-34712)
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityThe wsrep_notify_cmd functionality was susceptible to a parameter-injection vulnerability, as it failed to validate the peer-supplied wsrep_node_name and wsrep_node_incoming_address values before interpolating them into the notification command line MDEV-39721
securityCVE-2026-49261 (CVSS base score (v3.1): 10.0)
securityCVE-2026-48165 (CVSS base score (v3.1): 8.0)
breakingThe PERFORMANCE_SCHEMA instrument wait/synch/rwlock/innodb/log_latch was removed in order to improve throughput by 0.5% or more. (MDEV-39040)
breakingDefault expressions for table columns previously allowed an incompatible mix of collations with the functions IF, NVL2, IFNULL. Now ER_CANT_AGGREGATE_2COLLATIONS is returned. (MDEV-39002)
breakingThe Debian helper script previous tried to CHECK TABLE on all Aria/MyiSAM tables. The discovery and execution though a combination of bash and SQL escaping that resulted in incorrect table names being checked in a variety of situtions. Because Aria has crash recovery the Debian's auto-check table…
Security advisories
6.4 CVE-2026-107822 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
7.2 CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
6.4 CVE-2026-107816 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
4.4 CVE-2026-107817 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
8.4 CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
8.0 CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
8.5 CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
8.4 CVE-2026-107814 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
8.0 CVE-2026-48163 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, duri…
8.0 CVE-2026-48165 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a hi…
9.1 CVE-2026-44172 MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and…
5.0 CVE-2026-44173 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, Mari…
8.0 CVE-2026-44168 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, duri…
4.3 CVE-2026-44169 MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a ro…
9.8 CVE-2026-44170 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, Mari…
6.3 CVE-2026-44171 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbst…
10.0 CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notif…
6.5 CVE-2026-35549 An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user…
8.5 CVE-2026-32710 MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function.…
4.3 CVE-2026-3494 In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated dat…