> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/community-server/10.6/10.6.28.md).

# MariaDB 10.6.28 Release Notes

<a href="https://mariadb.com/downloads/community" class="button primary">Download</a> <a href="/pages/cAjEGLW9rLNvtJUWAIFV" class="button secondary">Release Notes</a> <a href="/pages/UcJ15nJuSCd61ILMIuYQ" class="button secondary">Changelog</a> <a href="/pages/YAt68pS41edDyVfCf4LP" class="button secondary">Overview of 10.6</a>

[<sup>*Alternate download from mariadb.org*</sup>](https://downloads.mariadb.org/mariadb/10.6.28/)

**Release date:** TBD

[MariaDB 10.6](/docs/release-notes/community-server/10.6/what-is-mariadb-106.md) is a long-term series of MariaDB, [maintained until](https://mariadb.org/about/#maintenance-policy) July 2026. It is an evolution of [MariaDB 10.5](/docs/release-notes/community-server/old-releases/10.5/what-is-mariadb-105.md) with several entirely new features.

MariaDB 10.6.28 is a [***Stable (GA)***](/docs/release-notes/community-server/about/release-criteria.md) release.

{% hint style="info" %}

<p align="center"><strong>This is the final release in the MariaDB 10.6 series.</strong></p>
{% endhint %}

{% hint style="success" %}
**For an overview of MariaDB 10.6 see the** [**MariaDB 10.6 Changes & Improvements**](/docs/release-notes/community-server/10.6/what-is-mariadb-106.md) **page.**
{% endhint %}

Thanks, and enjoy MariaDB!

## Notable Items

### Storage Engines

#### InnoDB Storage Engine

* Some race conditions were fixed in the INFORMATION\_SCHEMA views innodb\_trx, innodb\_locks, innodb\_lock\_waits. ([MDEV-39344](https://jira.mariadb.org/browse/MDEV-39344))

#### Archive Storage Engine

* REPAIR command on ARCHIVE table destroys TEXT Data ([MDEV-24245](https://jira.mariadb.org/browse/MDEV-24245))

#### Aria Storage Engine

* Symlinked table name is not encoded ([MDEV-40358](https://jira.mariadb.org/browse/MDEV-40358))
* MyISAM/Aria silently truncate extensions from filenames, if too long ([MDEV-40395](https://jira.mariadb.org/browse/MDEV-40395))

#### Connect Storage Engine

* Fix Static Application Security Testing(SAST) warnings in Connect storage engine ([MDEV-40316](https://jira.mariadb.org/browse/MDEV-40316))
* CONNECT file udfs ignore FILE and secure\_file\_priv ([MDEV-40323](https://jira.mariadb.org/browse/MDEV-40323))
* CONNECT REST can pass arguments to curl via HTTP parameter ([MDEV-40360](https://jira.mariadb.org/browse/MDEV-40360))
* CONNECT writes unvalidated data from remote server into fixed-len buffer ([MDEV-40426](https://jira.mariadb.org/browse/MDEV-40426))
* CONNECT crashes on double(255,50) in DOS table ([MDEV-40637](https://jira.mariadb.org/browse/MDEV-40637))

#### CSV Storage Engine

* When running a DELETE on a table which is using the CSV storage engine, the server can crash ([MDEV-40636](https://jira.mariadb.org/browse/MDEV-40636))

#### Mroonga Storage Engine

* Changing a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash ([MDEV-39556](https://jira.mariadb.org/browse/MDEV-39556))

#### MyISAM Storage Engine

* MyISAM crash on corrupted MYI with invalid keyseg length ([MDEV-39816](https://jira.mariadb.org/browse/MDEV-39816))

#### RocksDB Storage Engine

* 32-bit size truncation in RocksDB ([MDEV-39812](https://jira.mariadb.org/browse/MDEV-39812))

### Authentication and Privilege System

* Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) ([MDEV-39047](https://jira.mariadb.org/browse/MDEV-39047))
* An appropriately privileged user (with SUPER or SYSTEM\_VARIABLES\_ADMIN privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable wsrep\_sst\_auth , which can be modified at runtime, were not properly sanitized when used to construct a shell command ([MDEV-40027](https://jira.mariadb.org/browse/MDEV-40027))
* An appropriately privileged user (with SUPER privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable wsrep\_node\_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command ([MDEV-40056](https://jira.mariadb.org/browse/MDEV-40056))
* Single quotes make SHOW CREATE USER invalid ([MDEV-40308](https://jira.mariadb.org/browse/MDEV-40308))
* GRANT PROXY with empty password incorrectly checks grantor's privileges ([MDEV-40470](https://jira.mariadb.org/browse/MDEV-40470))

### Dynamic Columns

* Dynamic column header missing sanity checks ([MDEV-39581](https://jira.mariadb.org/browse/MDEV-39581))
* Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter; fix thanks to Syed Mohammed Nayyar ([MDEV-40200](https://jira.mariadb.org/browse/MDEV-40200))

### Galera

* When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. ([MDEV-28233](https://jira.mariadb.org/browse/MDEV-28233))
* State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server) ([MDEV-23744](https://jira.mariadb.org/browse/MDEV-23744))
  * Eight new options are added, read from the \[sst] (or \[mysqld]) option group. Each one overrides the corresponding generic ssl-\* option for its role when set; when it is not set, the generic ssl-\* option is used, so existing configurations behave exactly as before.
  * Joiner (TLS server) role:
    * `ssl-server-ca` CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * `ssl-server-capath` CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * `ssl-server-cert` Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * `ssl-server-key` Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * Donor (TLS client) role:
    * `ssl-client-ca` CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * `ssl-client-capath` CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * `ssl-client-cert` Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * `ssl-client-key` Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * These are SST options read by the wsrep\_sst\_\* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
* Galera state transfers (SST) now interpret the ssl-mode=VERIFY\_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, VERIFY\_CA was incorrectly treated as strictly as VERIFY\_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY\_IDENTITY explicitly ([MDEV-28239](https://jira.mariadb.org/browse/MDEV-28239))
* Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds ([MDEV-35812](https://jira.mariadb.org/browse/MDEV-35812))
* Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer ([MDEV-38843](https://jira.mariadb.org/browse/MDEV-38843))
* Remove deprecated wsrep\_causal\_reads as a configuration option from provided wsrep.cnf ([MDEV-39691](https://jira.mariadb.org/browse/MDEV-39691))

### GIS

* ASAN error on malformed WKB point ([MDEV-39657](https://jira.mariadb.org/browse/MDEV-39657))
* ST\_GeomFromGeoJSON in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. ([MDEV-39813](https://jira.mariadb.org/browse/MDEV-39813))
* `ST_GEOMFROMGEOJSON` when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object, thanks to Akshat Nehra of AWS for providing a solution to this ([MDEV-39981](https://jira.mariadb.org/browse/MDEV-39981))
* ASAN error on malformed WKB multipolygon ([MDEV-40328](https://jira.mariadb.org/browse/MDEV-40328))
* ST\_GeomFromText stack overrun on deeply nested GeometryCollection ([MDEV-40409](https://jira.mariadb.org/browse/MDEV-40409))
* ST\_GeomFromWKB stack overrun on deeply nested GeometryCollection ([MDEV-40540](https://jira.mariadb.org/browse/MDEV-40540))

### Information Schema

* SHOW CREATE TABLE corrupts \`-quoted table options ([MDEV-39776](https://jira.mariadb.org/browse/MDEV-39776))
* Backtick in FK names breaks SHOW CREATE TABLE ([MDEV-39818](https://jira.mariadb.org/browse/MDEV-39818))
* Single quote in DATA DIRECTORY breaks SHOW CREATE TABLE ([MDEV-40159](https://jira.mariadb.org/browse/MDEV-40159))

### JSON

* JSON functions on large input; JSON\_CONTAIN, JSON\_CONTAINS\_PATH, JSON\_EXISTS, JSON\_EXTRACT, and JSON\_KEYS; were previously uninterruptible with KILL query, and could exceed their maximum query time ([MDEV-28404](https://jira.mariadb.org/browse/MDEV-28404))
* JSON\_EXISTS was permitted to exceeded the depth for JSON functions ([MDEV-39276](https://jira.mariadb.org/browse/MDEV-39276))
* JSON\_ARRAYAGG() returns garbage because of off-by-one error ([MDEV-39817](https://jira.mariadb.org/browse/MDEV-39817))
* mysql\_json plugin OOB reads ([MDEV-40678](https://jira.mariadb.org/browse/MDEV-40678))
* On big-endian platforms, the interruption of the execution of JSON functions was previously not possible and this is now corrected; on all platforms the interruption of JSON\_OVERLAPS now returns the correct error code ([MDEV-30518](https://jira.mariadb.org/browse/MDEV-30518))

### Locking

* Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition ([MDEV-31808](https://jira.mariadb.org/browse/MDEV-31808))

### mariabackup

* Missing filename check in mariadb-backup --decompress ([MDEV-39565](https://jira.mariadb.org/browse/MDEV-39565))

### OTHER

* Fix a memory corruption by safely copying between overlapping memory regions ([MDEV-39450](https://jira.mariadb.org/browse/MDEV-39450))

### Packaging

* It was possible for a user with FILE privileges and a secure\_file\_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. ([MDEV-40629](https://jira.mariadb.org/browse/MDEV-40629))
* The stunnel is a dependency of the Galera rsync sst mechanism. Its optional until a TLS configuration is applied for the SST mechanism. Added stunnel as a recommended package for RPMs and Debian packages for MariaDB-server and in 12.3, a required package of MariaDB-server-galera. ([MDEV-40630](https://jira.mariadb.org/browse/MDEV-40630))

### Platform Windows

* Deleting from Aria table could result in a corrupt index on Windows ([MDEV-37000](https://jira.mariadb.org/browse/MDEV-37000))

### Plugin - File Key Management

* The file\_key\_management plugin can crash if the key file is empty ([MDEV-40658](https://jira.mariadb.org/browse/MDEV-40658))

### Protocol

* Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (skip\_name\_resolve is not set) ([MDEV-37556](https://jira.mariadb.org/browse/MDEV-37556))
* One-byte OOB write in PROXY protocol v1 header parser ([MDEV-39564](https://jira.mariadb.org/browse/MDEV-39564))
* PROXY v2 protocol uninitialized memory reads ([MDEV-39576](https://jira.mariadb.org/browse/MDEV-39576))

### Query Cache

* qc\_info OOB read if query contains \0 ([MDEV-40670](https://jira.mariadb.org/browse/MDEV-40670))

### Replication

* Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated Table\_map\_log\_event metadata, so a slave or mariadb-binlog --print-table-metadata now handle malformed table map events safely instead of crashing or leaking heap memory; thanks to Luke Lu of AWS for providing this fix ([MDEV-39689](https://jira.mariadb.org/browse/MDEV-39689))
* Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs ([MDEV-40298](https://jira.mariadb.org/browse/MDEV-40298))

### Scripts & Clients

* Provide fallback message logging function when they are not present ([MDEV-38075](https://jira.mariadb.org/browse/MDEV-38075))
* Bundled command-line clients don't always enforce length limits on server results ([MDEV-40065](https://jira.mariadb.org/browse/MDEV-40065))
* mariadb-dump doesn't always quote identifiers ([MDEV-40311](https://jira.mariadb.org/browse/MDEV-40311))

### Server

* group\_concat ignores max\_allowed\_packet ([MDEV-39673](https://jira.mariadb.org/browse/MDEV-39673))
* \#mysql50# mixes up with table names in the table cache and on disk ([MDEV-40362](https://jira.mariadb.org/browse/MDEV-40362))
* Insufficient validation of frm data when opening a table ([MDEV-40571](https://jira.mariadb.org/browse/MDEV-40571))

### Variables

* ASAN crash on invalid proxy\_protocol\_networks value ([MDEV-39658](https://jira.mariadb.org/browse/MDEV-39658))

### Views

* Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated ([MDEV-40484](https://jira.mariadb.org/browse/MDEV-40484))

### XML Functions

* ExtractValue does not control recursion depth ([MDEV-39750](https://jira.mariadb.org/browse/MDEV-39750))

## Changelog

For a complete list of changes made in MariaDB 10.6.28, with links to detailed information on each push, see the [changelog](/docs/release-notes/community-server/changelogs/10.6/10.6.28.md).

***

{% hint style="info" %}
Be notified of new MariaDB Server releases automatically by [subscribing](https://lists.mariadb.org/postorius/lists/announce.lists.mariadb.org/) to the MariaDB Foundation community announce 'at' lists.mariadb.org announcement list (this is a low traffic, announce-only list). MariaDB plc customers will be notified for all new releases, security issues and critical bug fixes for all MariaDB plc products thanks to the Notification Services.

MariaDB may already be included in your favorite OS distribution. More information can be found on the [Distributions which Include MariaDB](/docs/general-resources/distributions-including-mariadb.md) page.
{% endhint %}

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>

{% @marketo/form formid="4316" formId="4316" %}