MariaDB 10.6.26 Release Notes

MariaDB 10.6.26 is a Stable (GA) release of MariaDB Community Server 10.6, released on 2026-05-18

The most recent release of MariaDB Community Server 10.6 is: 10.6.28 Stable (GA)

Download Community Server 10.6.28

_{Alternate download from mariadb.org}

Download Release Notes Changelog Overview of 10.6

^{Alternate download from mariadb.org}

Release date: 18 May 2026

MariaDB 10.6 is a long-term series of MariaDB, maintained until July 2026. It is an evolution of MariaDB 10.5 with several entirely new features.

MariaDB 10.6.26 is a Stable (GA) release.

For an overview of MariaDB 10.6 see the MariaDB 10.6 Changes & Improvements page.

Thanks, and enjoy MariaDB!

Notable Items

Storage Engines

InnoDB

• Fixed a crash in InnoDB when processing long or encoded database names in Foreign Keys (MDEV-24356)

• CREATE TABLE ... SELECT on STATS table doesn't hang anymore (MDEV-38822)

• Fixed a server assertion that occurred when an InnoDB DDL operation (such as ALTER TABLE) encountered a lock wait timeout during internal statistics updates. (MDEV-38882)

• improved performance of innodb conversion operations between big/little endian (MDEV-39027)

• An UPDATE could fail to return the error ER_CHECKREAD when innodb_snapshot_isolation=ON and the transaction that had last modified the record was committed during the lock acquisition. (MDEV-39263)

Connect

• Invalid SRCDEF value could crash a CONNECT table (MDEV-38892)

• CONNECT OEM tables don't check subtype length (MDEV-39281)

• CONNECT REST support on Windows doesn't escape the url (MDEV-39289)

Mroonga

• A invalid Mroonga INDEX comment can result in a hang of the server. This has been corrected. (MDEV-39479)

Authentication and Privilege System

• By inserting a crafted large JSON value into the mysql.global_priv table and triggering FLUSH PRIVILEGES, the server can crash (MDEV-39266)

• FILE privilege isn't checked for derived table (MDEV-39493)

Backup

• Fixed mariabackup to report my_close() failures and prevent false success messages when disk space is exhausted. (MDEV-38562)

Data Definition - Alter Table

• Fixes the issue occurred when ALTER TABLE contained duplicate DROP FOREIGN KEY operations (e.g., "DROP FOREIGN KEY f1, DROP FOREIGN KEY f1"). (MDEV-19194)

• Fix InnoDB index corruption when renaming key names with case-only differences. (MDEV-34951)

• PAGE_COMPRESSED ALTER TABLE operations inconsistent with innodb_file_per_table setting (MDEV-37886)

Data types

• Change the "-0" results in many SELECT scenarios to just return "0". (MDEV-38670)

Encryption

• Crash recovery may fail after a crash during an instant ALTER TABLE…PAGE_COMPRESSED=1. Fix: make the operation rebuild the table. (MDEV-38079)

GIS

• Empty string is erroneously allowed as a GEOMETRY column value (MDEV-15479)

• ST_PointOnSurface returns NULL with Polygon in some case (MDEV-35766)

• Crash or incorrect result when st_geometryfromtext, st_geometryfromwkb, st_geomfromgeojson were getting non-constant NULL in the second or third argument. (MDEV-39319)

JSON

• "Warning: Memory not freed: 32" after server shutdown when SELECT COLUMN_JSON() has been used (MDEV-36929)

• JSON search functions, JSON_EXISTS, JSON_EXTRACT, JSON_VALUE, JSON_QUERY, JSON_CONTAINS, JSON_CONTAINS_PATH, JSON_ARRAY_APPEND, JSON_ARRAY_INSERT, JSON_LENGTH, JSON_INSERT, JSON_REMOVE, JSON_KEYS, could result in a overwrite of memory resulting in a crash. (MDEV-39213)

mariabackup

• mbstream insufficient path validation (MDEV-39408)

Platform Debian

• The Debian helper script previous tried to CHECK TABLE on all Aria/MyiSAM tables. The discovery and execution though a combination of bash and SQL escaping that resulted in incorrect table names being checked in a variety of situtions. Because Aria has crash recovery the Debian's auto-check table on startup functionality was removed. (MDEV-34902)

Replication

• Parallel replication hang and stall due to incorrectly handled row lock conflict, missing deadlock kill (MDEV-37133)

• Replica updates table to wrong values, further replication failures (MDEV-38731)

• [ERROR] Slave worker thread retried transaction 10 time(s) in vain, giving up. (MDEV-38776)

• Corrupted Gtid_log_event can cause a slave or mariadb-binlog crash (MDEV-39404)

Server

• Fixed a server crash that could occur during query optimization when a stored procedure queries a view containing CONCAT or GROUP_CONCAT functions. (MDEV-36678)

• Fixed critical crashes in InnoDB purge threads when processing tables with indexed virtual columns. Resolved race conditions where purge workers incorrectly reused cached TABLE* objects across different tables in the same batch, and added retry logic to handle concurrent DDL operations that could invalidate table handles during purge processing. (MDEV-39261)

wsrep

• wsrep unsafe handling of parameters (MDEV-39413)

XML Functions

• ExtractValue/UpdateXML can crash due to not handling <! and <? correctly (MDEV-39210)

Security

Fixes for the following security vulnerabilities:

CVE ID (with cve.org link)	CVSS base score (v3.1)
CVE-2026-47064	6.5
CVE-2026-44173	5.0
CVE-2026-44172	5.0
CVE-2026-44171	6.3
CVE-2026-44170	5.0
CVE-2026-44168	8.0

Changelog

For a complete list of changes made in MariaDB 10.6.26, with links to detailed information on each push, see the changelog.

---

Be notified of new MariaDB Server releases automatically by subscribing to the MariaDB Foundation community announce 'at' lists.mariadb.org announcement list (this is a low traffic, announce-only list). MariaDB plc customers will be notified for all new releases, security issues and critical bug fixes for all MariaDB plc products thanks to the Notification Services.

MariaDB may already be included in your favorite OS distribution. More information can be found on the Distributions which Include MariaDB page.

_{This page is licensed: CC BY-SA / Gnu FDL}