VersionDrift
Product

MariaDB 11.8.6 → 13.1.1

15 releases · 13 breaking changes · 64 security fixes · 16 advisories fixed

64security13breaking7deprecated154feature81fix

Is 11.8.6 affected?

Vulnerabilities fixed by this upgrade

  • 6.4 CVE-2026-107822 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
  • 7.2 CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
  • 6.4 CVE-2026-107816 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
  • 4.4 CVE-2026-107817 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
  • 8.4 CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
  • 8.0 CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
  • 8.5 CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
  • 8.4 CVE-2026-107814 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
  • 8.0 CVE-2026-48163 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, duri…
  • 8.0 CVE-2026-48165 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a hi…
  • 5.0 CVE-2026-44173 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, Mari…
  • 8.0 CVE-2026-44168 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, duri…
  • 4.3 CVE-2026-44169 MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a ro…
  • 9.8 CVE-2026-44170 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, Mari…
  • 6.3 CVE-2026-44171 MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbst…
  • 10.0 CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notif…

Breaking changes

  • breaking Remove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691) in 12.3.3
  • breaking Under --bootstrap mode, used in mariadb-install-db, an unwanted delay was removed and it now calls the plugin clean up functions (MDEV-39585) in 12.3.3
  • breaking The Galera package dependency has been removed from server packages and the Galera package is no longer included in the MariaDB repositories (MDEV-38744) in 12.3.1
  • breaking Remove depth limit of 32 from JSON functions (MDEV-32854) in 12.2.2
  • breaking Remove depth limit of 32 from JSON functions (MDEV-32854) in 12.2.1
  • breaking Galera-26.4.23 corrects an incompatibility with OpenZFS >= 2.3.0 enabling the use of galera on this filesystem. in 12.0.2
  • breaking Remove the error codes added to 10.11 by the MDEV-36032 patch (MDEV-36856) in 12.0.2
  • breaking SLES 15 SP6 and SLES 15 SP7 are new packages in this release. Because of incompatibilities of packages between SLES service pack versions there are now separate packages for 15sp6 and 15sp7. An upgradeable repo file should include "sles/$releasever/$basearch" rather than the "sles15-amd64" or… in 12.0.2
  • breaking Remove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691) in 11.8.9
  • breaking Under --bootstrap mode, used in mariadb-install-db, an unwanted delay was removed and it now calls the plugin clean up functions (MDEV-39585) in 11.8.9
  • breaking The PERFORMANCE_SCHEMA instrument wait/synch/rwlock/innodb/log_latch was removed in order to improve throughput by 0.5% or more. (MDEV-39040) in 11.8.7
  • breaking Default expressions for table columns previously allowed an incompatible mix of collations with the functions IF, NVL2, IFNULL. Now ER_CANT_AGGREGATE_2COLLATIONS is returned. (MDEV-39002) in 11.8.7
  • breaking The Debian helper script previous tried to CHECK TABLE on all Aria/MyiSAM tables. The discovery and execution though a combination of bash and SQL escaping that resulted in incorrect table names being checked in a variety of situtions. Because Aria has crash recovery the Debian's auto-check table… in 11.8.7

Security changes

  • security Fixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar… in 13.0.2
  • security Fixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d… in 13.0.2
  • security Fixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco… in 13.0.2
  • security Fixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an… in 13.0.2
  • security Fixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne… in 13.0.2
  • security Fixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg… in 13.0.2
  • security Fixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em… in 13.0.2
  • security Fixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont… in 13.0.2
  • security Fixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar… in 12.3.3
  • security Fixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d… in 12.3.3
  • security Fixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco… in 12.3.3
  • security Fixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an… in 12.3.3
  • security Fixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne… in 12.3.3
  • security Fixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg… in 12.3.3
  • security Fixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em… in 12.3.3
  • security Fixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont… in 12.3.3
  • security Fix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316) in 12.3.3
  • security CVE-2026-61081 (CVSS base score (v3.1): 2.7) in 12.3.3
  • security CVE-2026-60585 (CVSS base score (v3.1): 6.6) in 12.3.3
  • security CVE-2026-60331 (CVSS base score (v3.1): 6.4) in 12.3.3
  • security CVE-2026-60747 (CVSS base score (v3.1): 6.2) in 12.3.3
  • security CVE-2026-47023 (CVSS base score (v3.1): 4.9) in 12.3.3
  • security CVE-2026-60184 (CVSS base score (v3.1): 4.4) in 12.3.3
  • security CVE-2026-47064 (CVSS base score (v3.1): 6.5) in 12.3.2
  • security CVE-2026-44173 (CVSS base score (v3.1): 5.0) in 12.3.2
  • security CVE-2026-44172 (CVSS base score (v3.1): 5.0) in 12.3.2
  • security CVE-2026-44171 (CVSS base score (v3.1): 6.3) in 12.3.2
  • security CVE-2026-44170 (CVSS base score (v3.1): 5.0) in 12.3.2
  • security CVE-2026-44169 (CVSS base score (v3.1): 4.3) in 12.3.2
  • security CVE-2026-44168 (CVSS base score (v3.1): 8.0) in 12.3.2
  • security Fixes CVE-2026-35549: An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user… in 12.2.2
  • security Fixes for the following security vulnerabilities: in 12.2.2
  • security CVE-2026-32710 in 12.2.2
  • security Fixes for the following security vulnerabilities: in 12.1.2
  • security CVE-2026-21968 in 12.1.2
  • security Support for passphrase protected keys (MDEV-14091) in 12.0.1
  • security New SET SESSION AUTHORIZATION (MDEV-20299) in 12.0.1
  • security Implement SHA2 support for file_key_management.so plugin (TDE) (MDEV-34712) in 12.0.1
  • security Fixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar… in 11.8.9
  • security Fixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d… in 11.8.9
  • security Fixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco… in 11.8.9
  • security Fixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an… in 11.8.9
  • security Fixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne… in 11.8.9
  • security Fixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg… in 11.8.9
  • security Fixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em… in 11.8.9
  • security Fixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont… in 11.8.9
  • security Fix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316) in 11.8.9
  • security CVE-2026-61081 (CVSS base score (v3.1): 2.7) in 11.8.9
  • security CVE-2026-60585 (CVSS base score (v3.1): 6.6) in 11.8.9
  • security CVE-2026-60331 (CVSS base score (v3.1): 6.4) in 11.8.9
  • security CVE-2026-60747 (CVSS base score (v3.1): 6.2) in 11.8.9
  • security CVE-2026-47023 (CVSS base score (v3.1): 4.9) in 11.8.9
  • security CVE-2026-60184 (CVSS base score (v3.1): 4.4) in 11.8.9
  • security The wsrep_notify_cmd functionality was susceptible to a parameter-injection vulnerability, as it failed to validate the peer-supplied wsrep_node_name and wsrep_node_incoming_address values before interpolating them into the notification command line MDEV-39721 in 11.8.8
  • security CVE-2026-49261 (CVSS base score (v3.1): 10.0) in 11.8.8
  • security CVE-2026-48165 (CVSS base score (v3.1): 8.0) in 11.8.8
  • security CVE-2026-48163 (CVSS base score (v3.1): 8.0) in 11.8.8
  • security CVE-2026-47064 (CVSS base score (v3.1): 6.5) in 11.8.7
  • security CVE-2026-44173 (CVSS base score (v3.1): 5.0) in 11.8.7
  • security CVE-2026-44172 (CVSS base score (v3.1): 5.0) in 11.8.7
  • security CVE-2026-44171 (CVSS base score (v3.1): 6.3) in 11.8.7
  • security CVE-2026-44170 (CVSS base score (v3.1): 5.0) in 11.8.7
  • security CVE-2026-44169 (CVSS base score (v3.1): 4.3) in 11.8.7
  • security CVE-2026-44168 (CVSS base score (v3.1): 8.0) in 11.8.7

Deprecations

  • deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 13.0 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42 in 13.0.1
  • deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 12.3 for Debian 11 "Bullseye" (i386, amd64 and arm64) in 12.3.3
  • deprecated Use of the MYSQLD_OPTS as an environment variable for systemd services is deprecated and will be removed in a later release. Place configuration option in configuration files in 12.3.2
  • deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 12.3 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42 in 12.3.2
  • deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 11.8 for Debian 11 "Bullseye" (i386, amd64 and arm64) in 11.8.9
  • deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 11.8 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42 in 11.8.8
  • deprecated wsrep_slave_FK_checks configuration option was deprecated and from no on has no effect. Slave foreign key checks are always on as otherwise leads to massive data inconsistency on all replicas which subsequently results in master node abort. (MDEV-38787) in 11.8.7

Every release in between

13.1.1 Sep 14, 2026 Release notes ↗
featureSupport for JSON operators column->path and column->>path (MDEV-13594)
featureDENY clause for access control a.k.a. "negative grants" (MDEV-14443)
featureAuto-adding new partitions for PARTITION BY RANGE (MDEV-15621)
featureImprove error reporting of mysqlbinlog when used with --flashback (MDEV-20749)
featureLocking full table scan fails to use table-level locking (MDEV-24813)
featureAdd formatted column support to JSON_TABLE (MDEV-25727)
featureIgnored domain ids skip validation when connecting to a master (MDEV-28213)
featureThe default utf8 character set is now utf8mb4 (MDEV-30041)
featureNew statement CREATE TRIGGER FOR { STARTUP | SHUTDOWN } (MDEV-30645)
featureOptional lengths for string types: VARCHAR[(N)] (MDEV-31414)
featuremariadbd --validate-config to check the configuration for validity without starting the server (MDEV-31527)
featuremariadb-dump no longer includes generated column values in a dump (MDEV-32362)
featureNEW and OLD in a trigger can be used as row variables (MDEV-34723)
featureINFORMATION_SCHEMA.VECTOR_INDEXES provides information about vector indexes (MDEV-34805)
featureparsec_iterations session variables allows to set the number of PBKDF2 rounds for PARSEC plugin (MDEV-35254)
featureADAPTIVE_HASH_INDEX = { YES | NO | DEFAULT } can specify per InnoDB table whether to use AHI (MDEV-37070)
featureXMLISVALID() schema validation function (MDEV-37262)
featureAND/OR can now short-circuit the execution for any argument not in a strictly left-to-right fashion (MDEV-37713, MDEV-37714)
featureXXH3 and XXH32 hash functions (MDEV-38180)
featureAdaptive hash index statistics is shown in ANALYZE FORMAT=JSON (MDEV-38305)
featureOptimizer Context Recorder to record the optimizer data and then analyze query optimization on another server instance (MDEV-38701)
featureinnodb_tablespace_size_warning_threshold and innodb_tablespace_size_warning_pct variables to get a warning when InnoDB tablespace is getting close to full (before it's 100% full and the service is disrupted) (MDEV-38936)
featureMEMORY tables support variable-length data types, VARCHAR and TEXT/BLOB (MDEV-38975)
featureLocal routine variables usable in PREPARE/EXECUTE/DEALLOCATE and OPEN ... FOR (MDEV-39022)
featurePackage-wide TYPE declarations (MDEV-39587)
featureCHECK TABLE supports MEMORY tables (MDEV-40030)
featureslave_skip_errors variable can be modified without server restart (MDEV-7394)
13.0.2 Sep 14, 2026 Release notes ↗
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityFixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
securityFixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
securityFixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
securityFixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
securityFixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
featureAdd support for TYPE .. IS REF CURSOR (MDEV-10152)
featureIn 13.0, REF CURSOR can be declared inside package routines and in a PACKAGE BODY, and used as a package routine local variable, package routine parameter, or package function RETURN type. It cannot yet be used as a parameter or RETURN type for global (non-package) routines.
featureSupport RECORD in routine parameters and function RETURN clause (MDEV-38768)
featureSame scope as REF CURSOR above: usable as a package routine parameter or package function RETURN type, not yet as a parameter or RETURN type for global (non-package) routines.
featureAdd init_rpl_role to SHOW VARIABLES output (MDEV-38202)
featureThe replication role set via the --init-rpl-role startup option can now be queried with SHOW VARIABLES LIKE 'init_rpl_role' or SELECT @@init_rpl_role, instead of only being visible in the server's configuration file.
featureOne can specify timestamp format for the audit plugin log (MDEV-18386)
featureAtomic CREATE OR REPLACE TABLE (MDEV-25292)
featureImplement UPDATE ... RETURNING for single-table updates (MDEV-5092)
featureCombined with OLD_VALUE(), an application can read back both the pre- and post-update values of changed columns in one round trip, without a separate SELECT. Only single-table UPDATE supports RETURNING; multi-table UPDATE does not yet.
featureINFORMATION_SCHEMA.SYSTEM_VARIABLES shows if a variable is deprecated (MDEV-35369)
featureAdds IS_DEPRECATED and DEPRECATED_REPLACEMENT columns, so tooling can query deprecation status directly instead of relying on release notes.
featureINFORMATION_SCHEMA.STATISTICS and INFORMATION_SCHEMA.COLUMNS shows engine specific create options (MDEV-36444)
featureOptimizer Trace includes used optimizer statistics (MDEV-36511)
featureNew innodb_log_archive variable makes InnoDB preserve the write-ahead log in a continuous sequence of files instead of overwriting a ring buffer, enabling point-in-time recovery and incremental backups (MDEV-37949)
featuremariadb-backup does not yet support the innodb_log_archive=ON log format, and fails if run against a server running with it enabled. See InnoDB Log Archiving and Point-in-Time Recovery for the manual procedure in the meantime.
featureNew QB_NAME() optimizer hint (MDEV-38045)
featureEvery view, CTE, and derived table now automatically gets an implicit query block name based on its own alias, so hints can target objects inside them without adding an explicit QB_NAME() hint first.
featureA new locator form of QB_NAME(), QB_NAME(name, query_block_path), lets a hint specify a path to a query block nested inside a view, CTE, or derived table that isn't reachable by its implicit or explicit name alone.
featureReversed executable comments (MDEV-7381)
otherCHANGE MASTER now resets Master_Server_Id in SHOW SLAVES STATUS (MDEV-15327)
otherFaster unique indexes over CHAR columns in MEMORY tables (incl. temporary tables) (MDEV-21543)
otherPERFORMANCE_SCHEMA now uses XXH3_128 hash for digest. Looks like MD5, but much faster and no problems in FIPS mode. (MDEV-31669)
otherbinlog_row_event_max_size default value was increased to 64k (MDEV-37608)
otherdefault_master_connection can now be set on global level (MDEV-9247)
13.0.1 May 29, 2026 Release notes ↗
featureAdd support for TYPE .. IS REF CURSOR (MDEV-10152)
featureOne can specify timestamp format for the audit plugin log (MDEV-18386)
featureAtomic CREATE OR REPLACE TABLE (MDEV-25292)
featureINFORMATION_SCHEMA.SYSTEM_VARIABLES shows if a variable is deprecated (MDEV-35369)
featureINFORMATION_SCHEMA.STATISTICS and INFORMATION_SCHEMA.COLUMNS shows engine specific create options (MDEV-36444)
featureOptimizer Trace includes used optimizer statistics (MDEV-36511)
featureNew innodb_log_archive variable makes InnoDB preserve the write-ahead log in a continuous sequence of files instead of overwriting a ring buffer, enabling point-in-time recovery and incremental backups (MDEV-37949)
featureNew QB_NAME() optimizer hint (MDEV-38045)
featureSupport RECORD in routine parameters and function RETURN clause (MDEV-38768)
featureReversed executable comments (MDEV-7381)
otherCHANGE MASTER now resets Master_Server_Id in SHOW SLAVES STATUS (MDEV-15327)
otherFaster unique indexes over CHAR columns in MEMORY tables (incl. temporary tables) (MDEV-21543)
otherPERFORMANCE_SCHEMA now uses XXH3_128 hash for digest. Looks like MD5, but much faster and no problems in FIPS mode. (MDEV-31669)
otherbinlog_row_event_max_size default value was increased to 64k (MDEV-37608)
otherdefault_master_connection can now be set on global level (MDEV-9247)
deprecatedAs per the MariaDB Deprecation Policy, this will be the last release of MariaDB 13.0 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42
12.3.3 Aug 24, 2026 Release notes ↗
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityFixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
securityFixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
securityFixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
securityFixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
securityFixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
fixIn --bootstrap mode, it was possible for a partially initialized InnoDB to be shutdown, and it was possible that this could crash the server (MDEV-39541)
fixFixed stale encryption metadata on compressed-only pages by clearing it, and fixed an assertion failure during extent reservation (MDEV-39795)
fixTruncate of temporary table with ENCRYPTED=NO crashes under innodb_encrypt_tables=FORCE (MDEV-40085)
fixFixed a rare InnoDB race during XA PREPARE where a concurrent buffer-pool resize could cause the wrong lock latch to be released, risking a hang or crash (MDEV-40218)
fixWhen executing crash recovery in multiple batches, InnoDB may fail to extend a file and crash on a subsequent write to it (MDEV-40756)
fixFixed an assertion failure with spatial index predicate locks (MDEV-39800)
fixFixed a performance regression in the oltp_read_write benchmark with transaction-isolation=READ-COMMITTED; regression introduced in 10.3 (MDEV-21423)
featureA new innodb_index_shrink system variable allows disabling InnoDB's ability to shrink a B-tree, by merging or reorganizing pages, on record-growing UPDATEs, such as NULL to not-NULL. The default ON matches the previous behavior. Setting it to OFF favors page splits in those cases, reducing index…
securityFix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316)
fixCONNECT crashes on double(255,50) in DOS table (MDEV-40637)
fixWhen running a DELETE on a table which is using the CSV storage engine, the server can crash (MDEV-40636)
fixDuckDB crashes when creating a temporary duckdb table (MDEV-40379)
fixChanging a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash (MDEV-39556)
fixMyISAM crash on corrupted MYI with invalid keyseg length (MDEV-39816)
fixServer crashes when executing the FLUSH PRIVILEGES statement after starting the server with skip-grant-tables and creating the mysql.host table (MDEV-37840)
featureSHOW TABLES allows users with only GRANT OPTION privilege to read all table names in the database "mysql" (MDEV-37951)
fixcached_sha2_password crashes on zero-length password (MDEV-40058)
fixPrepared Statement Crash in varchar_upper_cmp_transformer() for '?' (MDEV-40006)
fixToo long character_set_collations crash (MDEV-40059)
fixFixed a server crash during UNIQUE constraint checks or prefix index scans on empty BLOB/TEXT columns (MDEV-39559)
featureA 0xHHHH / b'..' literal kept its hex_hybrid type through COALESCE/IF/CASE/..., but was evaluated, sized and stored as a string, so it behaved differently from a bare literal (10+COALESCE(0x31) gave 11, not 59); type_handler_hex_hybrid now implements the numeric side to match the bare literal:…
fixFix signed-integer-overflow in BLOB-to-integer conversion (MDEV-39690)
fixFix division function to produce correct decimal zero without sign (MDEV-39744)
featureEight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.
featureThese are SST options read by the wsrep\sst\* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
fixFixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and…
breakingRemove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691)
fixFix incomplete cleanup in Galera MTR tests failing under --repeat (MDEV-38386)
fixA high priority abort, by the Galera replication applier may have left the aborted victim's transaction's Innodb lock orphaned in the lock wait queue, which in some scenarios can cause temporary node hanging or a crash; this version has a fix for handling the lock wait state of high priority…
fixFix for regression coming from MDEV-34924 , which refactors gtid_slave_pos table handling in replication; the fix here is for potential cluster hanging when DDL or Sequence access is replicated to a cluster by async replication (MDEV-38260)
featureJSON functions added in 11.4 are now interruptible with a KILL QUERY, or exceeding the max_statement_time, including JSON_ARRAY_INTERSECT, JSON_OBJECT_TO_ARRAY, JSON_SCHEMA_VALID; the JSON_KEY_VALUE function as a quick function added isn't applicable; all the functions now produce warnings on…
featureIt was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. (MDEV-40629)
+191 more items in the release notes
12.3.2 May 28, 2026 Release notes ↗
featureOracle TO_DATE() function (MDEV-19683)
featureSupport for cursors on prepared statements (MDEV-33830)
featureSQL Standard SET PATH statement (MDEV-34391)
featureSQL Standard IS JSON predicate (MDEV-37072)
featureAllow UPDATE/DELETE to read from a CTE (MDEV-37220)
featureBasic XML data type (MDEV-37261)
featureConfigurable defaults for MASTER_SSL_* settings for CHANGE MASTER (MDEV-28302)
featureFragment ROW replication events larger than max_packet_size (MDEV-32570)
featureImproving performance of binary logging by removing the need of syncing it (MDEV-34705)
featureHashicorp Plugin: Implement cache flush for forced key rotation (MDEV-30847)
featureNew hash algorithms for PARTITION BY KEY (MDEV-9826)
otherOptimize reorderable LEFT JOINs statements (MDEV-36055)
otherOptimize ordered scans over PARTITION BY RANGE (MDEV-37330)
featureA new mariadb-server-galera package now exists for Deb and RPM packages for ease of installing a galera system and pulling in its dependencies. Without galera, mariadb-server can be used
otherThose on Galera systems will need to install mariadb-server-galera explicitly as an upgrade from previous versions will result in galera dependencies being installed but not updated having a package dependency of MariaDB requiring them. Also the systemd service definitions will not be…
otherRPMs currently require explicit installation of galera-4 along with the any dependencies used for SST, such as rsync, socat, lsof, grep, gawk, iproute, coreutils, findutils, and/or tar
otherThe wsrep_info plugin is installed by default with the mariadb-server-galera package
otherOn an error in CREATE TEMPORARY TABLE ... SELECT, InnoDB internally aborted a transaction, while the server thought the transaction still existed. This caused various inconsistencies in the binary log, disappearing savepoints, and more. The issue was fixed differently in different versions. In…
otherAudit log plugin will now log events for MariaDB Cluster (Galera) replication applier operations with a generic user name: . Before this change the user name in audit logs has been empty (MDEV-35511)
deprecatedUse of the MYSQLD_OPTS as an environment variable for systemd services is deprecated and will be removed in a later release. Place configuration option in configuration files
deprecatedAs per the MariaDB Deprecation Policy, this will be the last release of MariaDB 12.3 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42
securityCVE-2026-47064 (CVSS base score (v3.1): 6.5)
securityCVE-2026-44173 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44172 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44171 (CVSS base score (v3.1): 6.3)
securityCVE-2026-44170 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44169 (CVSS base score (v3.1): 4.3)
securityCVE-2026-44168 (CVSS base score (v3.1): 8.0)
12.3.1 Feb 12, 2026 Release notes ↗
featureOracle TO_DATE() function (MDEV-19683)
featureSupport for cursors on prepared statements (MDEV-33830)
featureSQL Standard SET PATH statement (MDEV-34391)
featureSQL Standard IS JSON predicate (MDEV-37072)
featureAllow UPDATE/DELETE to read from a CTE (MDEV-37220)
featureBasic XML data type (MDEV-37261)
featureConfigurable defaults for MASTER_SSL_* settings for CHANGE MASTER (MDEV-28302)
featureFragment ROW replication events larger than max_packet_size (MDEV-32570)
featureImproving performance of binary logging by removing the need of syncing it (MDEV-34705)
featureHashicorp Plugin: Implement cache flush for forced key rotation (MDEV-30847)
featureNew hash algorithms for PARTITION BY KEY (MDEV-9826)
otherOptimize reorderable LEFT JOIN statements (MDEV-36055)
otherOptimize ordered scans over PARTITION BY RANGE (MDEV-37330)
breakingThe Galera package dependency has been removed from server packages and the Galera package is no longer included in the MariaDB repositories (MDEV-38744)
otherOn an error in CREATE TEMPORARY TABLE ... SELECT, InnoDB internally aborted a transaction, while the server thought the transaction still existed. This caused various inconsistencies in the binary log, disappearing savepoints, and more. The issue was fixed differently in different versions. In…
otherAudit log plugin will now log events for MariaDB Cluster (Galera) replication applier operations with a generic user name: . Before this change the user name in audit logs has been empty (MDEV-35511)
12.2.2 Feb 12, 2026 Release notes ↗
securityFixes CVE-2026-35549: An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user…
featureImplement Oracle TO_NUMBER function (MDEV-20022)
featureImplement Oracle TRUNC function (MDEV-20023)
featureJoin optimizer is now able to infer that derived table with GROUP BY clause has distinct GROUP BY columns (MDEV-36321)
featureOptimizer hint: [NO_]ROWID_FILTER (MDEV-36089)
featureOptimizer hint: [NO_]INDEX_MERGE (MDEV-36125)
featureOptimizer hints: Implicit query block names (MDEV-37511)
breakingRemove depth limit of 32 from JSON functions (MDEV-32854)
featureAdd INFORMATION_SCHEMA.TRIGGERED_UPDATE_COLUMNS (MDEV-36996)
featureImplement INFORMATION_SCHEMA.PARAMETERS.PARAMETER_DEFAULT column (MDEV-37054)
otherOn an error in CREATE TEMPORARY TABLE ... SELECT, InnoDB internally aborted a transaction, while the server thought the transaction still existed. This caused various inconsistencies in the binary log, disappearing savepoints, and more. The issue was fixed differently in different versions. In…
otherAudit log plugin will now log events for MariaDB Cluster (Galera) replication applier operations with a generic user name: . Before this change the user name in audit logs has been empty (MDEV-35511)
securityFixes for the following security vulnerabilities:
securityCVE-2026-32710
12.2.1 Nov 21, 2025 Release notes ↗
featureOptimizer hint: [NO_]ROWID_FILTER (MDEV-36089)
featureOptimizer hint: [NO_]INDEX_MERGE (MDEV-36125)
featureOptimizer hints: Implicit query block names (MDEV-37511)
featureImplement Oracle TO_NUMBER function (MDEV-20022)
featureImplement Oracle TRUNC function (MDEV-20023)
breakingRemove depth limit of 32 from JSON functions (MDEV-32854)
otherIndexes on derived tables with GROUP BY produce wrong out_rows estimates (MDEV-36321)
featureAdd INFORMATION_SCHEMA.TRIGGERED_UPDATE_COLUMNS (MDEV-36996)
featureImplement INFORMATION_SCHEMA.PARAMETERS.PARAMETER_DEFAULT column (MDEV-37054)
12.1.2 Nov 18, 2025 Release notes ↗
featureSegmented key cache for Aria storage engine (MDEV-24)
featureThe new aria_pagecache_segments system variable defines how many segments are used, default is 1, maximum 128
featureMDL scalability improvements (MDEV-19749)
featureAsynchronous replication between two Galera Clusters can now use parallel replication
featureThis is managed by the new wsrep_applier_retry_count system variable (MDEV-20065)
featureThe audit plugin now supports buffered logging
featureThe size of the buffer is defined using the new system variable server_audit_file_buffer_size (MDEV-34680)
featureFaster vector distance calculations via extrapolation (MDEV-36205)
featureNew authentication plugin caching_sha2_password for MySQL compatibility (MDEV-9804)
feature( + ) for outer join syntax in Oracle mode (MDEV-13817)
featureAssociative arrays: DECLARE TYPE .. TABLE OF .. INDEX BY (MDEV-34319) (blog post)
featureDROP USER will now by default issue a warning if the user has active sessions, or fail in Oracle mode (MDEV-35617)
featureOptimizer hints: [[NO\]JOIN_INDEX](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/ha-and-performance/optimization-and-tuning/optimizer-hints#join_index-and-no_join_index),…
featureOptimizer hints: [[NO_]SPLIT_MATERIALIZED](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/ha-and-performance/optimization-and-tuning/optimizer-hints#split_materialized-x-and-no_split_materialized-x) (MDEV-36092)
featureOptimizer hints: [[NO\]DERIVED_CONDITION_PUSHDOWN](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/ha-and-performance/optimization-and-tuning/optimizer-hints#derived_condition_pushdown-and-no_derived_condition_pushdown), [[NO\]MERGE…
otherRetry applying of write sets on Galera nodes (MDEV-36077)
otherControlled through the wsrep_applier_retry_count system variable
othermariadb-dump now supports wildcards with the -L or --wildcards option (MDEV-21376)
otherForeign key constraint names no longer need to be unique per database, only per table (MDEV-28933) (blog post)
featureSupport for functional indexes in GROUP/ORDER BY (MDEV-36132)
otherInclude definitions of tables and views in the optimizer trace (MDEV-36483)
otheroptimizer_record_context system variable.
securityFixes for the following security vulnerabilities:
securityCVE-2026-21968
12.1.1 Aug 7, 2025 Release notes ↗
featureSegmented key cache for Aria storage engine (MDEV-24)
featurearia_pagecache_segments system variable
featureMDL scalability improvements (MDEV-19749)
featureParallel replication for Galera replicas (MDEV-20065)
featureBuffered logging for audit plugin (MDEV-34680)
featureFaster vector distance calculations via extrapolation (MDEV-36205)
featurecaching_sha2_password plugin (MDEV-9804)
feature( + ) for outer join syntax (MDEV-13817)
featureAdd semisynchronous replication variable, rpl_semi_sync_master_wait_for_slave_count (MDEV-18983)
featureAssociative arrays: DECLARE TYPE .. TABLE OF .. INDEX BY (MDEV-34319)
featureDROP USER will now by default issue a warning if the user has active sessions, or fail in Oracle mode (MDEV-35617)
featureOptimizer hints: [NO]JOIN_INDEX, [NO]GROUP\INDEX, [NO]ORDER\INDEX, [NO]INDEX (MDEV-35856)
featureOptimizer hints: [NO_]SPLIT_MATERIALIZED (MDEV-36092)
featureOptimizer hints: [NO]DERIVED_CONDITION_PUSHDOWN, [NO]MERGE (MDEV-36106)
featureAdd analyze_max_length option to not collect statistics for long char/varchars (MDEV-36536)
otherRetry applying of write sets on galera nodes (MDEV-36077)
othermariadb-dump now supports wildcards with the -L or --wildcards option (MDEV-21376)
otherPer-table unique FOREIGN KEY constraint names (MDEV-28933)
featureSupport for functional indexes in GROUP/ORDER BY (MDEV-36132)
otherInclude definitions of tables and views in the optimizer trace (MDEV-36483)
12.0.2 Aug 7, 2025 Release notes ↗
otherAfter SET GLOBAL innodb_buffer_pool_size was aborted while attempting to shrink the buffer pool, executing SET GLOBAL innodb_adaptive_hash_index=ON could lead to corruption of the adaptive hash index. (MDEV-36863)
otherFatal InnoDB error: Unknown error Temp file write failure (MDEV-36017)
fixWhen innodb_buffer_pool_size is being shrunk while there are no data pages cached, InnoDB could hang or crash. (MDEV-37263)
otherAfter a successful shrinking of innodb_buffer_pool_size, there will be no message about it in the server error log.
otherAfter a failed shrinking of innodb_buffer_pool_size, the adaptive hash index will not be re-enabled if innodb_adaptive_hash_index was ON when SET GLOBAL innodb_buffer_pool_size=... started to execute. (MDEV-36868)
otherAUTO_INCREMENT leads to non-serializable on results (MDEV-36330)
otherVector index was corrupted if one statement was rolled back (e.g. insert violating a unique constraint) in the middle of a larger transaction. (MDEV-37068)
featureThe new parameter innodb_linux_aio controls which Linux implementation to use for innodb_use_native_aio=ON. (MDEV-36234)
otherinnodb_linux_aio=auto is equivalent to innodb_linux_aio=io_uring when it is available, and falling back to innodb_linux_aio=aio when not.
featurePreviously, only one implementation (libaio or io_uring) was available. Currently, if io_uring is disabled in the environment, we will fall back to the older libaio interface.
otherAssertion when adding FK to MyISAM/Aria table with a vector index (MDEV-37022)
otherAdding (with ALTER TABLE) a UNIQUE constraint that is USING HASH to a table with foreign keys could've caused the table to become corrupted. (MDEV-36852)
otherDROP DEFAULT makes SHOW CREATE non-idempotent (MDEV-29001)
fixServer crashes in do_mark_index_columns instead of ER_DUP_ENTRY on partitioned table (MDEV-36817)
fixA replica would crash while replicating UPDATE and DELETE DML statements that target a table which previously had a partition that was converted to a separate table via ALTER TABLE .. CONVERT PARTITION .. TO TABLE. For example, if the command looked like ALTER TABLE t1 CONVERT PARTITION p1 TO…
otherCREATE OR REPLACE with self-referencing CHECK hangs forever, cannot be killed (MDEV-29155)
otherSegfault on INTERSECT ALL with UNION in Oracle mode (MDEV-25158)
otherIn certain cases privileges on sequences were too restrictive, for example, SELECT on a table might've erroneously required INSERT privilege on a sequences (MDEV-36870)
fixThis commit fixes a bug where Aria tables are used in (master->slave1->slave2) and a backup is taken on slave2. In this case it is possible that the replication position in the backup, stored in mysql.gtid_slave_pos, will be wrong. This will lead to replication errors if one is trying to use the…
fixMaria-backup would crash during the 'maria_recovery' part. This could happen if server was doing repair or creating indexes while the backup was running. (MDEV-36860)
fixMariaDB server crash when a query includes a derived table containing unnamed column. (MDEV-24588)
fixCrash in add_keyuses_for_splitting() when joining with a derived table (MDEV-30711)
otherSplit Materialized code: last_refills is never set in 11.0+ (MDEV-36323)
otherDon't generate index_merge plans, if a column is present in both Secondary Key and Primary Key indexes and either of the indexes include it with DESC order (as the scan itself is not a ROR scan). (MDEV-36410)
otherIncorrect handling of null values on join conditions. (MDEV-37057)
otherStarting from 10.11.12, Incorrect handling of UTF-8 characters (and other character sets requiring more than a single byte representation) in the minimum/maximum positions of a table during the execution of ANALYZE TABLE tbl PERSISTENT FOR ALL resulted in an endless loop consuming more memory and…
otherGalera updated to 26.4.23
othergalera_3nodes.inconsistency_shutdown test occasionally hangs (MDEV-36968)
breakingGalera-26.4.23 corrects an incompatibility with OpenZFS >= 2.3.0 enabling the use of galera on this filesystem.
othersemi sync makes the master unresponsive when a replica is stopped (MDEV-36934)
otherparallel slave ALTER-SEQUNCE attempted to binlog out-of-order (MDEV-35570)
othermysqldump --dump-slave always starts stopped slave (MDEV-7611)
otherOptimize Rows_log_event Reporting of Process Info (MDEV-36839)
otherSeconds_Behind_Master Spike at Log Rotation on Parallel Replication (MDEV-36840)
fixCrash when calling stored function in FOR loop argument (MDEV-26115)
otherALTER TABLE require ALTER privilege on sequence from DEFAULT value expression (MDEV-36280)
breakingRemove the error codes added to 10.11 by the MDEV-36032 patch (MDEV-36856)
featureAdd analyze_max_length option to not collect statistics for long char/varchars (MDEV-36536)
breakingSLES 15 SP6 and SLES 15 SP7 are new packages in this release. Because of incompatibilities of packages between SLES service pack versions there are now separate packages for 15sp6 and 15sp7. An upgradeable repo file should include "sles/$releasever/$basearch" rather than the "sles15-amd64" or…
featureFedora 42 is a new release version and x86_64 and aarch64 packages are available (MDBF-1060)
+12 more items in the release notes
12.0.1 Jun 5, 2025 Release notes ↗
securitySupport for passphrase protected keys (MDEV-14091)
securityNew SET SESSION AUTHORIZATION (MDEV-20299)
securityImplement SHA2 support for file_key_management.so plugin (TDE) (MDEV-34712)
otherComparison ROW(stored_func(),1)=ROW(1,1) erroneously called stored_func() twice per row. It led to a performance degradation, as well as to a double execution of the possible stored function side effects. (MDEV-36322)
featureAdd support for the pre-defined weak SYS_REFCURSOR (MDEV-20034)
otherTO_CHAR FM format not recognized in SQL_MODE=Oracle (MDEV-36216)
otherSupport mariadb-check and CHECK TABLE with SEQUENCE (MDEV-22491)
otherfind_order_in_list mismatch when order item needs fixing() (MDEV-36607)
otherIf the join_condition is specified via USING (column_list), the query plan depends on the sequence of tables in the query (MDEV-36592)
featureAdd support for optimizer hints (MDEV-35504)
otherQB_NAME()
otherNO_RANGE_OPTIMIZATION()
otherNO_ICP()
otherMRR(), NO_MRR()
otherBKA(), NO_BKA()
otherBNL(), NO_BNL()
featureAdd support for subquery optimizer hints (MDEV-34888)
otherSEMIJOIN()
otherSUBQUERY()
featureAdd support for join order hints (MDEV-34870)
otherJOIN_FIXED_ORDER similar to existing STRAIGHT_JOIN hint
otherJOIN_ORDER to apply the specified table order
otherJOIN_PREFIX to hint what tables should be first in the join
otherJOIN_SUFFIX to hint what tables should be last in the join
featureAdd support for the MAX_EXECUTION_TIME hint (MDEV-34860)
otherST_Validate (MDEV-34137)
otherMBRCoveredBy (MDEV-34138)
otherST_Simplify (MDEV-34141)
otherST_GeoHash (MDEV-34158)
otherST_LatFromGeoHash (MDEV-34159)
otherST_LongFromGeoHash (MDEV-34160)
otherST_PointFromGeoHash (MDEV-34277)
otherST_IsValid (MDEV-34276)
otherST_Collect (MDEV-34278)
featureAdd support for TRIGGERS that fire on multiple events (MDEV-10164)
otherServer now displays if it was started with skip-slave-start option (MDEV-27669)
otherSkip FK checks in Galera during applying in IST (MDEV-34822)
otherLog HOST:PORT of incoming connection instead of just the host (MDEV-1282)
featureAdd tls_version field for connection audit plugins (MDEV-33834)
otherGet option group suffix from $MARIADB_GROUP_SUFFIX in addition to $MYSQL_GROUP_SUFFIX (MDEV-21375)
+1 more item in the release notes
11.8.9 Aug 24, 2026 Release notes ↗
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityFixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
securityFixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
securityFixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
securityFixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
securityFixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
fixIn --bootstrap mode, it was possible for a partially initialized InnoDB to be shutdown, and it was possible that this could crash the server (MDEV-39541)
fixFixed stale encryption metadata on compressed-only pages by clearing it, and fixed an assertion failure during extent reservation (MDEV-39795)
fixTruncate of temporary table with ENCRYPTED=NO crashes under innodb_encrypt_tables=FORCE (MDEV-40085)
fixFixed a rare InnoDB race during XA PREPARE where a concurrent buffer-pool resize could cause the wrong lock latch to be released, risking a hang or crash (MDEV-40218)
fixWhen executing crash recovery in multiple batches, InnoDB may fail to extend a file and crash on a subsequent write to it (MDEV-40756)
fixFixed an assertion failure with spatial index predicate locks (MDEV-39800)
fixFixed a performance regression in the oltp_read_write benchmark with transaction-isolation=READ-COMMITTED; regression introduced in 10.3 (MDEV-21423)
featureA new innodb_index_shrink system variable allows disabling InnoDB's ability to shrink a B-tree, by merging or reorganizing pages, on record-growing UPDATEs, such as NULL to not-NULL. The default ON matches the previous behavior. Setting it to OFF favors page splits in those cases, reducing index…
securityFix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316)
fixCONNECT crashes on double(255,50) in DOS table (MDEV-40637)
fixWhen running a DELETE on a table which is using the CSV storage engine, the server can crash (MDEV-40636)
fixDuckDB crashes when creating a temporary duckdb table (MDEV-40379)
fixChanging a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash (MDEV-39556)
fixMyISAM crash on corrupted MYI with invalid keyseg length (MDEV-39816)
fixServer crashes when executing the FLUSH PRIVILEGES statement after starting the server with skip-grant-tables and creating the mysql.host table (MDEV-37840)
featureSHOW TABLES allows users with only GRANT OPTION privilege to read all table names in the database "mysql" (MDEV-37951)
fixcached_sha2_password crashes on zero-length password (MDEV-40058)
fixPrepared Statement Crash in varchar_upper_cmp_transformer() for '?' (MDEV-40006)
fixToo long character_set_collations crash (MDEV-40059)
fixFixed a server crash during UNIQUE constraint checks or prefix index scans on empty BLOB/TEXT columns (MDEV-39559)
featureA 0xHHHH / b'..' literal kept its hex_hybrid type through COALESCE/IF/CASE/..., but was evaluated, sized and stored as a string, so it behaved differently from a bare literal (10+COALESCE(0x31) gave 11, not 59); type_handler_hex_hybrid now implements the numeric side to match the bare literal:…
fixFix signed-integer-overflow in BLOB-to-integer conversion (MDEV-39690)
fixFix division function to produce correct decimal zero without sign (MDEV-39744)
featureEight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.
featureThese are SST options read by the wsrep\sst\* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
fixFixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and…
breakingRemove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691)
fixFix incomplete cleanup in Galera MTR tests failing under --repeat (MDEV-38386)
fixA high priority abort, by the Galera replication applier may have left the aborted victim's transaction's Innodb lock orphaned in the lock wait queue, which in some scenarios can cause temporary node hanging or a crash; this version has a fix for handling the lock wait state of high priority…
fixFix for regression coming from MDEV-34924 , which refactors gtid_slave_pos table handling in replication; the fix here is for potential cluster hanging when DDL or Sequence access is replicated to a cluster by async replication (MDEV-38260)
featureJSON functions added in 11.4 are now interruptible with a KILL QUERY, or exceeding the max_statement_time, including JSON_ARRAY_INTERSECT, JSON_OBJECT_TO_ARRAY, JSON_SCHEMA_VALID; the JSON_KEY_VALUE function as a quick function added isn't applicable; all the functions now produce warnings on…
featureIt was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. (MDEV-40629)
+190 more items in the release notes
11.8.8 May 27, 2026 Release notes ↗
otherA parameter-injection gap existed in wsrep_sst_rsync because it failed to validate the joiner-supplied WSREP_SST_OPT_REMOTE_USER and WSREP_SST_OPT_REMOTE_PSWD values before interpolating them into the donor-written stunnel.conf and the rsync magic file MDEV-39648
otherAn appropriately privileged user (with SUPER privileges) could execute shell commands as the uid of the mariadbd process because the values of the system variables wsrep_sst_donor and wsrep_sst_receive_address, which can be modified at runtime, were not properly sanitized when used to construct a…
securityThe wsrep_notify_cmd functionality was susceptible to a parameter-injection vulnerability, as it failed to validate the peer-supplied wsrep_node_name and wsrep_node_incoming_address values before interpolating them into the notification command line MDEV-39721
otherIn a multi-table UPDATE, the table list could incorrectly include tables that were not opened because they were not truly modified. This occurred when an UPDATE modified a table referenced by a foreign key constraint from a table that was not part of the multi-table update MDEV-3968
otherGalera updated to 26.4.27
otherThe server failed to parse schema-qualified table names when the unquoted table name began with a digit MDEV-39654
deprecatedAs per the MariaDB Deprecation Policy, this will be the last release of MariaDB 11.8 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42
securityCVE-2026-49261 (CVSS base score (v3.1): 10.0)
securityCVE-2026-48165 (CVSS base score (v3.1): 8.0)
securityCVE-2026-48163 (CVSS base score (v3.1): 8.0)
11.8.7 May 14, 2026 Release notes ↗
fixFixed a crash in InnoDB when processing long or encoded database names in Foreign Keys (MDEV-24356)
fixFixed an assertion failure during system tablespace defragmentation caused by incomplete resource latching when an extent became full. (MDEV-37294)
fixFixed an issue where the InnoDB system tablespace failed to shrink due to legacy internal tables. MariaDB now automatically detects and removes these orphaned entries during startup, allowing for successful defragmentation and reduction of the tablespace size. (MDEV-38412)
fixFixed a server assertion that occurred when an InnoDB DDL operation (such as ALTER TABLE) encountered a lock wait timeout during internal statistics updates. (MDEV-38882)
breakingThe PERFORMANCE_SCHEMA instrument wait/synch/rwlock/innodb/log_latch was removed in order to improve throughput by 0.5% or more. (MDEV-39040)
fixFixed a critical assertion failure in InnoDB that occurred during consecutive ALTER IGNORE TABLE operations when using the COPY algorithm. The fix prevents a race condition where the background purge thread could "pin" a table object while it was being renamed or dropped, leading to a server…
fixInvalid SRCDEF value could crash a CONNECT table (MDEV-38892)
fixcrash in information_schema.table_constraints when --skip-grant-tables (MDEV-38811)
fixBy inserting a crafted large JSON value into the mysql.global_priv table and triggering FLUSH PRIVILEGES, the server can crash (MDEV-39266)
fixFixed mariabackup to report my_close() failures and prevent false success messages when disk space is exhausted. (MDEV-38562)
fixFixed incorrectly formatted session tracking info in OK packet, after changing to database with UTF16/UTF32 default charset (MDEV-38954)
breakingDefault expressions for table columns previously allowed an incompatible mix of collations with the functions IF, NVL2, IFNULL. Now ER_CANT_AGGREGATE_2COLLATIONS is returned. (MDEV-39002)
fixFixes the issue occurred when ALTER TABLE contained duplicate DROP FOREIGN KEY operations (e.g., "DROP FOREIGN KEY f1, DROP FOREIGN KEY f1"). (MDEV-19194)
fixFix InnoDB index corruption when renaming key names with case-only differences. (MDEV-34951)
fixFixes the optimization of ALTER IGNORE TABLE...ALGORITHM=COPY (MDEV-36436) causes the assertion on InnoDB temporary table, partition table and also during partial rollback. (MDEV-38928)
fixFix crash in UPDATE ... FOR PARTITION OF. (MDEV-39356)
fixInvalid formats to to_char under some circumstances could crash the server. (MDEV-28136)
fixFix crash when comparing ROW types containing stored routines (MDEV-36792)
fixCrash recovery may fail after a crash during an instant ALTER TABLE…PAGE_COMPRESSED=1. Fix: make the operation rebuild the table. (MDEV-38079)
deprecatedwsrep_slave_FK_checks configuration option was deprecated and from no on has no effect. Slave foreign key checks are always on as otherwise leads to massive data inconsistency on all replicas which subsequently results in master node abort. (MDEV-38787)
fixRegression on MDL conflict handling (MDEV-38895)
fixCrash or incorrect result when st_geometryfromtext, st_geometryfromwkb, st_geomfromgeojson were getting non-constant NULL in the second or third argument. (MDEV-39319)
fixIn SELECT statements where a HAVING claused used JSON_KEYS the server could crash. This has been corrected. (MDEV-33984)
fixCorrected a server crash that could occur when strings where appended in a JSON_NORMALIZE SQL function. (MDEV-37640)
featureJSON_VALUE should not allow wildcard in the path since it is not supposed to return multiple values as per json standards. (MDEV-38835)
fixJSON search functions, JSON_EXISTS, JSON_EXTRACT, JSON_VALUE, JSON_QUERY, JSON_CONTAINS, JSON_CONTAINS_PATH, JSON_ARRAY_APPEND, JSON_ARRAY_INSERT, JSON_LENGTH, JSON_INSERT, JSON_REMOVE, JSON_KEYS, could result in a overwrite of memory resulting in a crash. (MDEV-39213)
fixCrash when pushing condition with always false IS NULL into derived (MDEV-29360)
featureAdded ProtectControlGroups=true to MariaDB's systemd service definitions (MDEV-39057)
fixMariaDB crashes when parsing fuzzer generated PARTITION (MDEV-36362)
fixFixed a server crash in the InnoDB purge thread caused by missing indexed virtual column data in the undo log during UPDATE operations. (MDEV-39081)
breakingThe Debian helper script previous tried to CHECK TABLE on all Aria/MyiSAM tables. The discovery and execution though a combination of bash and SQL escaping that resulted in incorrect table names being checked in a variety of situtions. Because Aria has crash recovery the Debian's auto-check table…
fixServer hangs or crashes upon FLUSH QUERY CACHE (MDEV-25365)
fixFixed an issue where a parallel replica configured to skip ER_CONNECTION_KILLED (i.e. --slave-skip-errors=1927) can hang or crash because it honored this configuration, but should not (this error code is internally repurposed for replication worker threads and cannot be ignored). (MDEV-38624)
securityCVE-2026-47064 (CVSS base score (v3.1): 6.5)
securityCVE-2026-44173 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44172 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44171 (CVSS base score (v3.1): 6.3)
securityCVE-2026-44170 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44169 (CVSS base score (v3.1): 4.3)
securityCVE-2026-44168 (CVSS base score (v3.1): 8.0)
+96 more items in the release notes
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status