MariaDB 11.8.9 → 13.1.1
12 releases · 8 breaking changes · 38 security fixes · 0 advisories fixed
38security8breaking4deprecated145feature31fix
Breaking changes
- breaking Remove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691) in 12.3.3
- breaking Under --bootstrap mode, used in mariadb-install-db, an unwanted delay was removed and it now calls the plugin clean up functions (MDEV-39585) in 12.3.3
- breaking The Galera package dependency has been removed from server packages and the Galera package is no longer included in the MariaDB repositories (MDEV-38744) in 12.3.1
- breaking Remove depth limit of 32 from JSON functions (MDEV-32854) in 12.2.2
- breaking Remove depth limit of 32 from JSON functions (MDEV-32854) in 12.2.1
- breaking Galera-26.4.23 corrects an incompatibility with OpenZFS >= 2.3.0 enabling the use of galera on this filesystem. in 12.0.2
- breaking Remove the error codes added to 10.11 by the MDEV-36032 patch (MDEV-36856) in 12.0.2
- breaking SLES 15 SP6 and SLES 15 SP7 are new packages in this release. Because of incompatibilities of packages between SLES service pack versions there are now separate packages for 15sp6 and 15sp7. An upgradeable repo file should include "sles/$releasever/$basearch" rather than the "sles15-amd64" or… in 12.0.2
Security changes
- security Fixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar… in 13.0.2
- security Fixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d… in 13.0.2
- security Fixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco… in 13.0.2
- security Fixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an… in 13.0.2
- security Fixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne… in 13.0.2
- security Fixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg… in 13.0.2
- security Fixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em… in 13.0.2
- security Fixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont… in 13.0.2
- security Fixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar… in 12.3.3
- security Fixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d… in 12.3.3
- security Fixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco… in 12.3.3
- security Fixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an… in 12.3.3
- security Fixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne… in 12.3.3
- security Fixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg… in 12.3.3
- security Fixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em… in 12.3.3
- security Fixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont… in 12.3.3
- security Fix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316) in 12.3.3
- security CVE-2026-61081 (CVSS base score (v3.1): 2.7) in 12.3.3
- security CVE-2026-60585 (CVSS base score (v3.1): 6.6) in 12.3.3
- security CVE-2026-60331 (CVSS base score (v3.1): 6.4) in 12.3.3
- security CVE-2026-60747 (CVSS base score (v3.1): 6.2) in 12.3.3
- security CVE-2026-47023 (CVSS base score (v3.1): 4.9) in 12.3.3
- security CVE-2026-60184 (CVSS base score (v3.1): 4.4) in 12.3.3
- security CVE-2026-47064 (CVSS base score (v3.1): 6.5) in 12.3.2
- security CVE-2026-44173 (CVSS base score (v3.1): 5.0) in 12.3.2
- security CVE-2026-44172 (CVSS base score (v3.1): 5.0) in 12.3.2
- security CVE-2026-44171 (CVSS base score (v3.1): 6.3) in 12.3.2
- security CVE-2026-44170 (CVSS base score (v3.1): 5.0) in 12.3.2
- security CVE-2026-44169 (CVSS base score (v3.1): 4.3) in 12.3.2
- security CVE-2026-44168 (CVSS base score (v3.1): 8.0) in 12.3.2
- security Fixes CVE-2026-35549: An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user… in 12.2.2
- security Fixes for the following security vulnerabilities: in 12.2.2
- security CVE-2026-32710 in 12.2.2
- security Fixes for the following security vulnerabilities: in 12.1.2
- security CVE-2026-21968 in 12.1.2
- security Support for passphrase protected keys (MDEV-14091) in 12.0.1
- security New SET SESSION AUTHORIZATION (MDEV-20299) in 12.0.1
- security Implement SHA2 support for file_key_management.so plugin (TDE) (MDEV-34712) in 12.0.1
Deprecations
- deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 13.0 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42 in 13.0.1
- deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 12.3 for Debian 11 "Bullseye" (i386, amd64 and arm64) in 12.3.3
- deprecated Use of the MYSQLD_OPTS as an environment variable for systemd services is deprecated and will be removed in a later release. Place configuration option in configuration files in 12.3.2
- deprecated As per the MariaDB Deprecation Policy, this will be the last release of MariaDB 12.3 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42 in 12.3.2
Every release in between
featureSupport for JSON operators column->path and column->>path (MDEV-13594)
featureDENY clause for access control a.k.a. "negative grants" (MDEV-14443)
featureAuto-adding new partitions for PARTITION BY RANGE (MDEV-15621)
featureImprove error reporting of mysqlbinlog when used with --flashback (MDEV-20749)
featureLocking full table scan fails to use table-level locking (MDEV-24813)
featureAdd formatted column support to JSON_TABLE (MDEV-25727)
featureIgnored domain ids skip validation when connecting to a master (MDEV-28213)
featureThe default utf8 character set is now utf8mb4 (MDEV-30041)
featureNew statement CREATE TRIGGER FOR { STARTUP | SHUTDOWN } (MDEV-30645)
featureOptional lengths for string types: VARCHAR[(N)] (MDEV-31414)
featuremariadbd --validate-config to check the configuration for validity without starting the server (MDEV-31527)
featuremariadb-dump no longer includes generated column values in a dump (MDEV-32362)
featureNEW and OLD in a trigger can be used as row variables (MDEV-34723)
featureINFORMATION_SCHEMA.VECTOR_INDEXES provides information about vector indexes (MDEV-34805)
featureparsec_iterations session variables allows to set the number of PBKDF2 rounds for PARSEC plugin (MDEV-35254)
featureADAPTIVE_HASH_INDEX = { YES | NO | DEFAULT } can specify per InnoDB table whether to use AHI (MDEV-37070)
featureXMLISVALID() schema validation function (MDEV-37262)
featureAND/OR can now short-circuit the execution for any argument not in a strictly left-to-right fashion (MDEV-37713, MDEV-37714)
featureXXH3 and XXH32 hash functions (MDEV-38180)
featureAdaptive hash index statistics is shown in ANALYZE FORMAT=JSON (MDEV-38305)
featureOptimizer Context Recorder to record the optimizer data and then analyze query optimization on another server instance (MDEV-38701)
featureinnodb_tablespace_size_warning_threshold and innodb_tablespace_size_warning_pct variables to get a warning when InnoDB tablespace is getting close to full (before it's 100% full and the service is disrupted) (MDEV-38936)
featureMEMORY tables support variable-length data types, VARCHAR and TEXT/BLOB (MDEV-38975)
featureLocal routine variables usable in PREPARE/EXECUTE/DEALLOCATE and OPEN ... FOR (MDEV-39022)
featurePackage-wide TYPE declarations (MDEV-39587)
featureCHECK TABLE supports MEMORY tables (MDEV-40030)
featureslave_skip_errors variable can be modified without server restart (MDEV-7394)
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityFixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
securityFixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
securityFixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
securityFixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
securityFixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
featureAdd support for TYPE .. IS REF CURSOR (MDEV-10152)
featureIn 13.0, REF CURSOR can be declared inside package routines and in a PACKAGE BODY, and used as a package routine local variable, package routine parameter, or package function RETURN type. It cannot yet be used as a parameter or RETURN type for global (non-package) routines.
featureSupport RECORD in routine parameters and function RETURN clause (MDEV-38768)
featureSame scope as REF CURSOR above: usable as a package routine parameter or package function RETURN type, not yet as a parameter or RETURN type for global (non-package) routines.
featureAdd init_rpl_role to SHOW VARIABLES output (MDEV-38202)
featureThe replication role set via the --init-rpl-role startup option can now be queried with SHOW VARIABLES LIKE 'init_rpl_role' or SELECT @@init_rpl_role, instead of only being visible in the server's configuration file.
featureOne can specify timestamp format for the audit plugin log (MDEV-18386)
featureAtomic CREATE OR REPLACE TABLE (MDEV-25292)
featureImplement UPDATE ... RETURNING for single-table updates (MDEV-5092)
featureCombined with OLD_VALUE(), an application can read back both the pre- and post-update values of changed columns in one round trip, without a separate SELECT. Only single-table UPDATE supports RETURNING; multi-table UPDATE does not yet.
featureINFORMATION_SCHEMA.SYSTEM_VARIABLES shows if a variable is deprecated (MDEV-35369)
featureAdds IS_DEPRECATED and DEPRECATED_REPLACEMENT columns, so tooling can query deprecation status directly instead of relying on release notes.
featureINFORMATION_SCHEMA.STATISTICS and INFORMATION_SCHEMA.COLUMNS shows engine specific create options (MDEV-36444)
featureOptimizer Trace includes used optimizer statistics (MDEV-36511)
featureNew innodb_log_archive variable makes InnoDB preserve the write-ahead log in a continuous sequence of files instead of overwriting a ring buffer, enabling point-in-time recovery and incremental backups (MDEV-37949)
featuremariadb-backup does not yet support the innodb_log_archive=ON log format, and fails if run against a server running with it enabled. See InnoDB Log Archiving and Point-in-Time Recovery for the manual procedure in the meantime.
featureNew QB_NAME() optimizer hint (MDEV-38045)
featureEvery view, CTE, and derived table now automatically gets an implicit query block name based on its own alias, so hints can target objects inside them without adding an explicit QB_NAME() hint first.
featureA new locator form of QB_NAME(), QB_NAME(name, query_block_path), lets a hint specify a path to a query block nested inside a view, CTE, or derived table that isn't reachable by its implicit or explicit name alone.
featureReversed executable comments (MDEV-7381)
otherCHANGE MASTER now resets Master_Server_Id in SHOW SLAVES STATUS (MDEV-15327)
otherFaster unique indexes over CHAR columns in MEMORY tables (incl. temporary tables) (MDEV-21543)
otherPERFORMANCE_SCHEMA now uses XXH3_128 hash for digest. Looks like MD5, but much faster and no problems in FIPS mode. (MDEV-31669)
otherbinlog_row_event_max_size default value was increased to 64k (MDEV-37608)
otherdefault_master_connection can now be set on global level (MDEV-9247)
featureAdd support for TYPE .. IS REF CURSOR (MDEV-10152)
featureOne can specify timestamp format for the audit plugin log (MDEV-18386)
featureAtomic CREATE OR REPLACE TABLE (MDEV-25292)
featureINFORMATION_SCHEMA.SYSTEM_VARIABLES shows if a variable is deprecated (MDEV-35369)
featureINFORMATION_SCHEMA.STATISTICS and INFORMATION_SCHEMA.COLUMNS shows engine specific create options (MDEV-36444)
featureOptimizer Trace includes used optimizer statistics (MDEV-36511)
featureNew innodb_log_archive variable makes InnoDB preserve the write-ahead log in a continuous sequence of files instead of overwriting a ring buffer, enabling point-in-time recovery and incremental backups (MDEV-37949)
featureNew QB_NAME() optimizer hint (MDEV-38045)
featureSupport RECORD in routine parameters and function RETURN clause (MDEV-38768)
featureReversed executable comments (MDEV-7381)
otherCHANGE MASTER now resets Master_Server_Id in SHOW SLAVES STATUS (MDEV-15327)
otherFaster unique indexes over CHAR columns in MEMORY tables (incl. temporary tables) (MDEV-21543)
otherPERFORMANCE_SCHEMA now uses XXH3_128 hash for digest. Looks like MD5, but much faster and no problems in FIPS mode. (MDEV-31669)
otherbinlog_row_event_max_size default value was increased to 64k (MDEV-37608)
otherdefault_master_connection can now be set on global level (MDEV-9247)
deprecatedAs per the MariaDB Deprecation Policy, this will be the last release of MariaDB 13.0 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42
securityFixes CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundar…
securityFixes CVE-2026-107818: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster d…
securityFixes CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service acco…
securityFixes CVE-2026-107821: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, an…
securityFixes CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded ne…
securityFixes CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privileg…
securityFixes CVE-2026-107816: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing em…
securityFixes CVE-2026-107817: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables cont…
fixIn --bootstrap mode, it was possible for a partially initialized InnoDB to be shutdown, and it was possible that this could crash the server (MDEV-39541)
fixFixed stale encryption metadata on compressed-only pages by clearing it, and fixed an assertion failure during extent reservation (MDEV-39795)
fixTruncate of temporary table with ENCRYPTED=NO crashes under innodb_encrypt_tables=FORCE (MDEV-40085)
fixFixed a rare InnoDB race during XA PREPARE where a concurrent buffer-pool resize could cause the wrong lock latch to be released, risking a hang or crash (MDEV-40218)
fixWhen executing crash recovery in multiple batches, InnoDB may fail to extend a file and crash on a subsequent write to it (MDEV-40756)
fixFixed an assertion failure with spatial index predicate locks (MDEV-39800)
fixFixed a performance regression in the oltp_read_write benchmark with transaction-isolation=READ-COMMITTED; regression introduced in 10.3 (MDEV-21423)
featureA new innodb_index_shrink system variable allows disabling InnoDB's ability to shrink a B-tree, by merging or reorganizing pages, on record-growing UPDATEs, such as NULL to not-NULL. The default ON matches the previous behavior. Setting it to OFF favors page splits in those cases, reducing index…
securityFix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316)
fixCONNECT crashes on double(255,50) in DOS table (MDEV-40637)
fixWhen running a DELETE on a table which is using the CSV storage engine, the server can crash (MDEV-40636)
fixDuckDB crashes when creating a temporary duckdb table (MDEV-40379)
fixChanging a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash (MDEV-39556)
fixMyISAM crash on corrupted MYI with invalid keyseg length (MDEV-39816)
fixServer crashes when executing the FLUSH PRIVILEGES statement after starting the server with skip-grant-tables and creating the mysql.host table (MDEV-37840)
featureSHOW TABLES allows users with only GRANT OPTION privilege to read all table names in the database "mysql" (MDEV-37951)
fixcached_sha2_password crashes on zero-length password (MDEV-40058)
fixPrepared Statement Crash in varchar_upper_cmp_transformer() for '?' (MDEV-40006)
fixToo long character_set_collations crash (MDEV-40059)
fixFixed a server crash during UNIQUE constraint checks or prefix index scans on empty BLOB/TEXT columns (MDEV-39559)
featureA 0xHHHH / b'..' literal kept its hex_hybrid type through COALESCE/IF/CASE/..., but was evaluated, sized and stored as a string, so it behaved differently from a bare literal (10+COALESCE(0x31) gave 11, not 59); type_handler_hex_hybrid now implements the numeric side to match the bare literal:…
fixFix signed-integer-overflow in BLOB-to-integer conversion (MDEV-39690)
fixFix division function to produce correct decimal zero without sign (MDEV-39744)
featureEight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.
featureThese are SST options read by the wsrep\sst\* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
fixFixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and…
breakingRemove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691)
fixFix incomplete cleanup in Galera MTR tests failing under --repeat (MDEV-38386)
fixA high priority abort, by the Galera replication applier may have left the aborted victim's transaction's Innodb lock orphaned in the lock wait queue, which in some scenarios can cause temporary node hanging or a crash; this version has a fix for handling the lock wait state of high priority…
fixFix for regression coming from MDEV-34924 , which refactors gtid_slave_pos table handling in replication; the fix here is for potential cluster hanging when DDL or Sequence access is replicated to a cluster by async replication (MDEV-38260)
featureJSON functions added in 11.4 are now interruptible with a KILL QUERY, or exceeding the max_statement_time, including JSON_ARRAY_INTERSECT, JSON_OBJECT_TO_ARRAY, JSON_SCHEMA_VALID; the JSON_KEY_VALUE function as a quick function added isn't applicable; all the functions now produce warnings on…
featureIt was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. (MDEV-40629)
+191 more items in the release notesfeatureOracle TO_DATE() function (MDEV-19683)
featureSupport for cursors on prepared statements (MDEV-33830)
featureSQL Standard SET PATH statement (MDEV-34391)
featureSQL Standard IS JSON predicate (MDEV-37072)
featureAllow UPDATE/DELETE to read from a CTE (MDEV-37220)
featureBasic XML data type (MDEV-37261)
featureConfigurable defaults for MASTER_SSL_* settings for CHANGE MASTER (MDEV-28302)
featureFragment ROW replication events larger than max_packet_size (MDEV-32570)
featureImproving performance of binary logging by removing the need of syncing it (MDEV-34705)
featureHashicorp Plugin: Implement cache flush for forced key rotation (MDEV-30847)
featureNew hash algorithms for PARTITION BY KEY (MDEV-9826)
otherOptimize reorderable LEFT JOINs statements (MDEV-36055)
otherOptimize ordered scans over PARTITION BY RANGE (MDEV-37330)
featureA new mariadb-server-galera package now exists for Deb and RPM packages for ease of installing a galera system and pulling in its dependencies. Without galera, mariadb-server can be used
otherThose on Galera systems will need to install mariadb-server-galera explicitly as an upgrade from previous versions will result in galera dependencies being installed but not updated having a package dependency of MariaDB requiring them. Also the systemd service definitions will not be…
otherRPMs currently require explicit installation of galera-4 along with the any dependencies used for SST, such as rsync, socat, lsof, grep, gawk, iproute, coreutils, findutils, and/or tar
otherThe wsrep_info plugin is installed by default with the mariadb-server-galera package
otherOn an error in CREATE TEMPORARY TABLE ... SELECT, InnoDB internally aborted a transaction, while the server thought the transaction still existed. This caused various inconsistencies in the binary log, disappearing savepoints, and more. The issue was fixed differently in different versions. In…
otherAudit log plugin will now log events for MariaDB Cluster (Galera) replication applier operations with a generic user name: . Before this change the user name in audit logs has been empty (MDEV-35511)
deprecatedUse of the MYSQLD_OPTS as an environment variable for systemd services is deprecated and will be removed in a later release. Place configuration option in configuration files
deprecatedAs per the MariaDB Deprecation Policy, this will be the last release of MariaDB 12.3 for OpenSUSE Leap 15.6, Ubuntu 25.10 "Questing Quokka", Ubuntu 25.04 "Plucky Puffin", and Fedora 42
securityCVE-2026-47064 (CVSS base score (v3.1): 6.5)
securityCVE-2026-44173 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44172 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44171 (CVSS base score (v3.1): 6.3)
securityCVE-2026-44170 (CVSS base score (v3.1): 5.0)
securityCVE-2026-44169 (CVSS base score (v3.1): 4.3)
securityCVE-2026-44168 (CVSS base score (v3.1): 8.0)
featureOracle TO_DATE() function (MDEV-19683)
featureSupport for cursors on prepared statements (MDEV-33830)
featureSQL Standard SET PATH statement (MDEV-34391)
featureSQL Standard IS JSON predicate (MDEV-37072)
featureAllow UPDATE/DELETE to read from a CTE (MDEV-37220)
featureBasic XML data type (MDEV-37261)
featureConfigurable defaults for MASTER_SSL_* settings for CHANGE MASTER (MDEV-28302)
featureFragment ROW replication events larger than max_packet_size (MDEV-32570)
featureImproving performance of binary logging by removing the need of syncing it (MDEV-34705)
featureHashicorp Plugin: Implement cache flush for forced key rotation (MDEV-30847)
featureNew hash algorithms for PARTITION BY KEY (MDEV-9826)
otherOptimize reorderable LEFT JOIN statements (MDEV-36055)
otherOptimize ordered scans over PARTITION BY RANGE (MDEV-37330)
breakingThe Galera package dependency has been removed from server packages and the Galera package is no longer included in the MariaDB repositories (MDEV-38744)
otherOn an error in CREATE TEMPORARY TABLE ... SELECT, InnoDB internally aborted a transaction, while the server thought the transaction still existed. This caused various inconsistencies in the binary log, disappearing savepoints, and more. The issue was fixed differently in different versions. In…
otherAudit log plugin will now log events for MariaDB Cluster (Galera) replication applier operations with a generic user name: . Before this change the user name in audit logs has been empty (MDEV-35511)
securityFixes CVE-2026-35549: An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user…
featureImplement Oracle TO_NUMBER function (MDEV-20022)
featureImplement Oracle TRUNC function (MDEV-20023)
featureJoin optimizer is now able to infer that derived table with GROUP BY clause has distinct GROUP BY columns (MDEV-36321)
featureOptimizer hint: [NO_]ROWID_FILTER (MDEV-36089)
featureOptimizer hint: [NO_]INDEX_MERGE (MDEV-36125)
featureOptimizer hints: Implicit query block names (MDEV-37511)
breakingRemove depth limit of 32 from JSON functions (MDEV-32854)
featureAdd INFORMATION_SCHEMA.TRIGGERED_UPDATE_COLUMNS (MDEV-36996)
featureImplement INFORMATION_SCHEMA.PARAMETERS.PARAMETER_DEFAULT column (MDEV-37054)
otherOn an error in CREATE TEMPORARY TABLE ... SELECT, InnoDB internally aborted a transaction, while the server thought the transaction still existed. This caused various inconsistencies in the binary log, disappearing savepoints, and more. The issue was fixed differently in different versions. In…
otherAudit log plugin will now log events for MariaDB Cluster (Galera) replication applier operations with a generic user name: . Before this change the user name in audit logs has been empty (MDEV-35511)
securityFixes for the following security vulnerabilities:
securityCVE-2026-32710
featureOptimizer hint: [NO_]ROWID_FILTER (MDEV-36089)
featureOptimizer hint: [NO_]INDEX_MERGE (MDEV-36125)
featureOptimizer hints: Implicit query block names (MDEV-37511)
featureImplement Oracle TO_NUMBER function (MDEV-20022)
featureImplement Oracle TRUNC function (MDEV-20023)
breakingRemove depth limit of 32 from JSON functions (MDEV-32854)
otherIndexes on derived tables with GROUP BY produce wrong out_rows estimates (MDEV-36321)
featureAdd INFORMATION_SCHEMA.TRIGGERED_UPDATE_COLUMNS (MDEV-36996)
featureImplement INFORMATION_SCHEMA.PARAMETERS.PARAMETER_DEFAULT column (MDEV-37054)
featureSegmented key cache for Aria storage engine (MDEV-24)
featureThe new aria_pagecache_segments system variable defines how many segments are used, default is 1, maximum 128
featureMDL scalability improvements (MDEV-19749)
featureAsynchronous replication between two Galera Clusters can now use parallel replication
featureThis is managed by the new wsrep_applier_retry_count system variable (MDEV-20065)
featureThe audit plugin now supports buffered logging
featureThe size of the buffer is defined using the new system variable server_audit_file_buffer_size (MDEV-34680)
featureFaster vector distance calculations via extrapolation (MDEV-36205)
featureNew authentication plugin caching_sha2_password for MySQL compatibility (MDEV-9804)
feature( + ) for outer join syntax in Oracle mode (MDEV-13817)
featureAssociative arrays: DECLARE TYPE .. TABLE OF .. INDEX BY (MDEV-34319) (blog post)
featureDROP USER will now by default issue a warning if the user has active sessions, or fail in Oracle mode (MDEV-35617)
featureOptimizer hints: [[NO\]JOIN_INDEX](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/ha-and-performance/optimization-and-tuning/optimizer-hints#join_index-and-no_join_index),…
featureOptimizer hints: [[NO_]SPLIT_MATERIALIZED](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/ha-and-performance/optimization-and-tuning/optimizer-hints#split_materialized-x-and-no_split_materialized-x) (MDEV-36092)
featureOptimizer hints: [[NO\]DERIVED_CONDITION_PUSHDOWN](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/ha-and-performance/optimization-and-tuning/optimizer-hints#derived_condition_pushdown-and-no_derived_condition_pushdown), [[NO\]MERGE…
otherRetry applying of write sets on Galera nodes (MDEV-36077)
otherControlled through the wsrep_applier_retry_count system variable
othermariadb-dump now supports wildcards with the -L or --wildcards option (MDEV-21376)
otherForeign key constraint names no longer need to be unique per database, only per table (MDEV-28933) (blog post)
featureSupport for functional indexes in GROUP/ORDER BY (MDEV-36132)
otherInclude definitions of tables and views in the optimizer trace (MDEV-36483)
otheroptimizer_record_context system variable.
securityFixes for the following security vulnerabilities:
securityCVE-2026-21968
featureSegmented key cache for Aria storage engine (MDEV-24)
featurearia_pagecache_segments system variable
featureMDL scalability improvements (MDEV-19749)
featureParallel replication for Galera replicas (MDEV-20065)
featureBuffered logging for audit plugin (MDEV-34680)
featureFaster vector distance calculations via extrapolation (MDEV-36205)
featurecaching_sha2_password plugin (MDEV-9804)
feature( + ) for outer join syntax (MDEV-13817)
featureAdd semisynchronous replication variable, rpl_semi_sync_master_wait_for_slave_count (MDEV-18983)
featureAssociative arrays: DECLARE TYPE .. TABLE OF .. INDEX BY (MDEV-34319)
featureDROP USER will now by default issue a warning if the user has active sessions, or fail in Oracle mode (MDEV-35617)
featureOptimizer hints: [NO]JOIN_INDEX, [NO]GROUP\INDEX, [NO]ORDER\INDEX, [NO]INDEX (MDEV-35856)
featureOptimizer hints: [NO_]SPLIT_MATERIALIZED (MDEV-36092)
featureOptimizer hints: [NO]DERIVED_CONDITION_PUSHDOWN, [NO]MERGE (MDEV-36106)
featureAdd analyze_max_length option to not collect statistics for long char/varchars (MDEV-36536)
otherRetry applying of write sets on galera nodes (MDEV-36077)
othermariadb-dump now supports wildcards with the -L or --wildcards option (MDEV-21376)
otherPer-table unique FOREIGN KEY constraint names (MDEV-28933)
featureSupport for functional indexes in GROUP/ORDER BY (MDEV-36132)
otherInclude definitions of tables and views in the optimizer trace (MDEV-36483)
otherAfter SET GLOBAL innodb_buffer_pool_size was aborted while attempting to shrink the buffer pool, executing SET GLOBAL innodb_adaptive_hash_index=ON could lead to corruption of the adaptive hash index. (MDEV-36863)
otherFatal InnoDB error: Unknown error Temp file write failure (MDEV-36017)
fixWhen innodb_buffer_pool_size is being shrunk while there are no data pages cached, InnoDB could hang or crash. (MDEV-37263)
otherAfter a successful shrinking of innodb_buffer_pool_size, there will be no message about it in the server error log.
otherAfter a failed shrinking of innodb_buffer_pool_size, the adaptive hash index will not be re-enabled if innodb_adaptive_hash_index was ON when SET GLOBAL innodb_buffer_pool_size=... started to execute. (MDEV-36868)
otherAUTO_INCREMENT leads to non-serializable on results (MDEV-36330)
otherVector index was corrupted if one statement was rolled back (e.g. insert violating a unique constraint) in the middle of a larger transaction. (MDEV-37068)
featureThe new parameter innodb_linux_aio controls which Linux implementation to use for innodb_use_native_aio=ON. (MDEV-36234)
otherinnodb_linux_aio=auto is equivalent to innodb_linux_aio=io_uring when it is available, and falling back to innodb_linux_aio=aio when not.
featurePreviously, only one implementation (libaio or io_uring) was available. Currently, if io_uring is disabled in the environment, we will fall back to the older libaio interface.
otherAssertion when adding FK to MyISAM/Aria table with a vector index (MDEV-37022)
otherAdding (with ALTER TABLE) a UNIQUE constraint that is USING HASH to a table with foreign keys could've caused the table to become corrupted. (MDEV-36852)
otherDROP DEFAULT makes SHOW CREATE non-idempotent (MDEV-29001)
fixServer crashes in do_mark_index_columns instead of ER_DUP_ENTRY on partitioned table (MDEV-36817)
fixA replica would crash while replicating UPDATE and DELETE DML statements that target a table which previously had a partition that was converted to a separate table via ALTER TABLE .. CONVERT PARTITION .. TO TABLE. For example, if the command looked like ALTER TABLE t1 CONVERT PARTITION p1 TO…
otherCREATE OR REPLACE with self-referencing CHECK hangs forever, cannot be killed (MDEV-29155)
otherSegfault on INTERSECT ALL with UNION in Oracle mode (MDEV-25158)
otherIn certain cases privileges on sequences were too restrictive, for example, SELECT on a table might've erroneously required INSERT privilege on a sequences (MDEV-36870)
fixThis commit fixes a bug where Aria tables are used in (master->slave1->slave2) and a backup is taken on slave2. In this case it is possible that the replication position in the backup, stored in mysql.gtid_slave_pos, will be wrong. This will lead to replication errors if one is trying to use the…
fixMaria-backup would crash during the 'maria_recovery' part. This could happen if server was doing repair or creating indexes while the backup was running. (MDEV-36860)
fixMariaDB server crash when a query includes a derived table containing unnamed column. (MDEV-24588)
fixCrash in add_keyuses_for_splitting() when joining with a derived table (MDEV-30711)
otherSplit Materialized code: last_refills is never set in 11.0+ (MDEV-36323)
otherDon't generate index_merge plans, if a column is present in both Secondary Key and Primary Key indexes and either of the indexes include it with DESC order (as the scan itself is not a ROR scan). (MDEV-36410)
otherIncorrect handling of null values on join conditions. (MDEV-37057)
otherStarting from 10.11.12, Incorrect handling of UTF-8 characters (and other character sets requiring more than a single byte representation) in the minimum/maximum positions of a table during the execution of ANALYZE TABLE tbl PERSISTENT FOR ALL resulted in an endless loop consuming more memory and…
otherGalera updated to 26.4.23
othergalera_3nodes.inconsistency_shutdown test occasionally hangs (MDEV-36968)
breakingGalera-26.4.23 corrects an incompatibility with OpenZFS >= 2.3.0 enabling the use of galera on this filesystem.
othersemi sync makes the master unresponsive when a replica is stopped (MDEV-36934)
otherparallel slave ALTER-SEQUNCE attempted to binlog out-of-order (MDEV-35570)
othermysqldump --dump-slave always starts stopped slave (MDEV-7611)
otherOptimize Rows_log_event Reporting of Process Info (MDEV-36839)
otherSeconds_Behind_Master Spike at Log Rotation on Parallel Replication (MDEV-36840)
fixCrash when calling stored function in FOR loop argument (MDEV-26115)
otherALTER TABLE require ALTER privilege on sequence from DEFAULT value expression (MDEV-36280)
breakingRemove the error codes added to 10.11 by the MDEV-36032 patch (MDEV-36856)
featureAdd analyze_max_length option to not collect statistics for long char/varchars (MDEV-36536)
breakingSLES 15 SP6 and SLES 15 SP7 are new packages in this release. Because of incompatibilities of packages between SLES service pack versions there are now separate packages for 15sp6 and 15sp7. An upgradeable repo file should include "sles/$releasever/$basearch" rather than the "sles15-amd64" or…
featureFedora 42 is a new release version and x86_64 and aarch64 packages are available (MDBF-1060)
+12 more items in the release notessecuritySupport for passphrase protected keys (MDEV-14091)
securityNew SET SESSION AUTHORIZATION (MDEV-20299)
securityImplement SHA2 support for file_key_management.so plugin (TDE) (MDEV-34712)
otherComparison ROW(stored_func(),1)=ROW(1,1) erroneously called stored_func() twice per row. It led to a performance degradation, as well as to a double execution of the possible stored function side effects. (MDEV-36322)
featureAdd support for the pre-defined weak SYS_REFCURSOR (MDEV-20034)
otherTO_CHAR FM format not recognized in SQL_MODE=Oracle (MDEV-36216)
otherSupport mariadb-check and CHECK TABLE with SEQUENCE (MDEV-22491)
otherfind_order_in_list mismatch when order item needs fixing() (MDEV-36607)
otherIf the join_condition is specified via USING (column_list), the query plan depends on the sequence of tables in the query (MDEV-36592)
featureAdd support for optimizer hints (MDEV-35504)
otherQB_NAME()
otherNO_RANGE_OPTIMIZATION()
otherNO_ICP()
otherMRR(), NO_MRR()
otherBKA(), NO_BKA()
otherBNL(), NO_BNL()
featureAdd support for subquery optimizer hints (MDEV-34888)
otherSEMIJOIN()
otherSUBQUERY()
featureAdd support for join order hints (MDEV-34870)
otherJOIN_FIXED_ORDER similar to existing STRAIGHT_JOIN hint
otherJOIN_ORDER to apply the specified table order
otherJOIN_PREFIX to hint what tables should be first in the join
otherJOIN_SUFFIX to hint what tables should be last in the join
featureAdd support for the MAX_EXECUTION_TIME hint (MDEV-34860)
otherST_Validate (MDEV-34137)
otherMBRCoveredBy (MDEV-34138)
otherST_Simplify (MDEV-34141)
otherST_GeoHash (MDEV-34158)
otherST_LatFromGeoHash (MDEV-34159)
otherST_LongFromGeoHash (MDEV-34160)
otherST_PointFromGeoHash (MDEV-34277)
otherST_IsValid (MDEV-34276)
otherST_Collect (MDEV-34278)
featureAdd support for TRIGGERS that fire on multiple events (MDEV-10164)
otherServer now displays if it was started with skip-slave-start option (MDEV-27669)
otherSkip FK checks in Galera during applying in IST (MDEV-34822)
otherLog HOST:PORT of incoming connection instead of just the host (MDEV-1282)
featureAdd tls_version field for connection audit plugins (MDEV-33834)
otherGet option group suffix from $MARIADB_GROUP_SUFFIX in addition to $MYSQL_GROUP_SUFFIX (MDEV-21375)
+1 more item in the release notes