MariaDB 10.6.28 Release Notes

MariaDB 10.6.28 is a Stable (GA) release of MariaDB Community Server 10.6, released on 2026-08-13

Download Release Notes Changelog Overview of 10.6

Release date: 13 Aug 2026

MariaDB 10.6 is a long-term series of MariaDB, maintained until July 2026. It is an evolution of MariaDB 10.5 with several entirely new features.

MariaDB 10.6.28 is a Stable (GA) release.

This is the final release in the MariaDB 10.6 series.

For an overview of MariaDB 10.6 see the MariaDB 10.6 Changes & Improvements page.

Thanks, and enjoy MariaDB!

Notable Items

Storage Engines

InnoDB Storage Engine

Some race conditions were fixed in the INFORMATION_SCHEMA views innodb_trx, innodb_locks, innodb_lock_waits. (MDEV-39344)

Archive Storage Engine

REPAIR command on ARCHIVE table destroys TEXT Data (MDEV-24245)

Aria Storage Engine

Symlinked table name is not encoded (MDEV-40358)
MyISAM/Aria silently truncate extensions from filenames, if too long (MDEV-40395)

Connect Storage Engine

Fix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316)
CONNECT file udfs ignore FILE and secure_file_priv (MDEV-40323)
CONNECT REST can pass arguments to curl via HTTP parameter (MDEV-40360)
CONNECT writes unvalidated data from remote server into fixed-len buffer (MDEV-40426)
CONNECT crashes on double(255,50) in DOS table (MDEV-40637)

CSV Storage Engine

When running a DELETE on a table which is using the CSV storage engine, the server can crash (MDEV-40636)

Mroonga Storage Engine

Changing a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash (MDEV-39556)

MyISAM Storage Engine

MyISAM crash on corrupted MYI with invalid keyseg length (MDEV-39816)

RocksDB Storage Engine

32-bit size truncation in RocksDB (MDEV-39812)

Authentication and Privilege System

Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) (MDEV-39047)
An appropriately privileged user (with SUPER or SYSTEM_VARIABLES_ADMIN privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable wsrep_sst_auth , which can be modified at runtime, were not properly sanitized when used to construct a shell command (MDEV-40027)
An appropriately privileged user (with SUPER privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable wsrep_node_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command (MDEV-40056)
Single quotes make SHOW CREATE USER invalid (MDEV-40308)
GRANT PROXY with empty password incorrectly checks grantor's privileges (MDEV-40470)

Dynamic Columns

Dynamic column header missing sanity checks (MDEV-39581)
Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter; fix thanks to Syed Mohammed Nayyar (MDEV-40200)

Galera

When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. (MDEV-28233)
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server) (MDEV-23744)
- Eight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.
- Joiner (TLS server) role:
  - ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
  - ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
  - ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
  - ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
- Donor (TLS client) role:
  - ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
  - ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
  - ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
  - ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
- These are SST options read by the wsrep_sst_* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly (MDEV-28239)
Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds (MDEV-35812)
Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer (MDEV-38843)
Remove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691)

GIS

ASAN error on malformed WKB point (MDEV-39657)
ST_GeomFromGeoJSON in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. (MDEV-39813)
ST_GEOMFROMGEOJSON when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object, thanks to Akshat Nehra of AWS for providing a solution to this (MDEV-39981)
ASAN error on malformed WKB multipolygon (MDEV-40328)
ST_GeomFromText stack overrun on deeply nested GeometryCollection (MDEV-40409)
ST_GeomFromWKB stack overrun on deeply nested GeometryCollection (MDEV-40540)

Information Schema

SHOW CREATE TABLE corrupts `-quoted table options (MDEV-39776)
Backtick in FK names breaks SHOW CREATE TABLE (MDEV-39818)
Single quote in DATA DIRECTORY breaks SHOW CREATE TABLE (MDEV-40159)

JSON

JSON functions on large input; JSON_CONTAIN, JSON_CONTAINS_PATH, JSON_EXISTS, JSON_EXTRACT, and JSON_KEYS; were previously uninterruptible with KILL query, and could exceed their maximum query time (MDEV-28404)
JSON_EXISTS was permitted to exceeded the depth for JSON functions (MDEV-39276)
JSON_ARRAYAGG() returns garbage because of off-by-one error (MDEV-39817)
mysql_json plugin OOB reads (MDEV-40678)
On big-endian platforms, the interruption of the execution of JSON functions was previously not possible and this is now corrected; on all platforms the interruption of JSON_OVERLAPS now returns the correct error code (MDEV-30518)

Locking

Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition (MDEV-31808)

mariabackup

Missing filename check in mariadb-backup --decompress (MDEV-39565)

OTHER

Memory corruption that can occur when updating a COMPRESSED column to a substring of its own value (e.g. UPDATE t SET c = RIGHT(c, n) or SUBSTRING(c, n)), when the column’s current value is short enough to be stored uncompressed (below column_compression_threshold, default 100 bytes)(MDEV-39450)

Packaging

It was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. (MDEV-40629)
The stunnel is a dependency of the Galera rsync sst mechanism. Its optional until a TLS configuration is applied for the SST mechanism. Added stunnel as a recommended package for RPMs and Debian packages for MariaDB-server and in 12.3, a required package of MariaDB-server-galera. (MDEV-40630)

Platform Windows

Deleting from Aria table could result in a corrupt index on Windows (MDEV-37000)

Plugin - File Key Management

The file_key_management plugin can crash if the key file is empty (MDEV-40658)

Protocol

Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (skip_name_resolve is not set) (MDEV-37556)
One-byte OOB write in PROXY protocol v1 header parser (MDEV-39564)
PROXY v2 protocol uninitialized memory reads (MDEV-39576)

Query Cache

qc_info OOB read if query contains \0 (MDEV-40670)

Replication

Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated Table_map_log_event metadata, so a slave or mariadb-binlog --print-table-metadata now handle malformed table map events safely instead of crashing or leaking heap memory; thanks to Luke Lu of AWS for providing this fix (MDEV-39689)
Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs (MDEV-40298)

Scripts & Clients

Provide fallback message logging function when they are not present (MDEV-38075)
Bundled command-line clients don't always enforce length limits on server results (MDEV-40065)
mariadb-dump doesn't always quote identifiers (MDEV-40311)

Server

group_concat ignores max_allowed_packet (MDEV-39673)
#mysql50# mixes up with table names in the table cache and on disk (MDEV-40362)
Insufficient validation of frm data when opening a table (MDEV-40571)

Variables

ASAN crash on invalid proxy_protocol_networks value (MDEV-39658)

Views

Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated (MDEV-40484)

XML Functions

ExtractValue does not control recursion depth (MDEV-39750)

Security

Fixes for the following security vulnerabilities:

CVE ID (with cve.org link)

CVSS base score (v3.1)

2.7

6.6

6.4

6.2

4.9

4.4

Changelog

For a complete list of changes made in MariaDB 10.6.28, with links to detailed information on each push, see the changelog.

Be notified of new MariaDB Server releases automatically by subscribing to the MariaDB Foundation community announce 'at' lists.mariadb.org announcement list (this is a low traffic, announce-only list). MariaDB plc customers will be notified for all new releases, security issues and critical bug fixes for all MariaDB plc products thanks to the Notification Services.

MariaDB may already be included in your favorite OS distribution. More information can be found on the Distributions which Include MariaDB page.

_{This page is licensed: CC BY-SA / Gnu FDL}

PreviousMariaDB 10.6 Changes & Improvements

NextMariaDB 10.6.27 Release Notes

Last updated 15 days ago

Was this helpful?