Webinar | Multcloud Disaster Recovery with MariaDB
Watch Now
Ctrlk
Download MariaDBContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Edit

Release Notes for MariaDB Enterprise Server 10.6.28-24

MariaDB Enterprise Server 10.6.28-24 is a Stable (GA) maintenance release of MariaDB Enterprise Server 10.6, released on 2026-09-07

Download Changelog Overview of Enterprise Server 10.6

Release date: 7 Sep 2026

MariaDB Enterprise Server 10.6.28-24 is a Stable (GA) maintenance release of MariaDB Enterprise Server 10.6. This release includes a variety of fixes.

See what's new in MariaDB Enterprise Server 10.6

Fixed Security Vulnerabilities

Some of these issues do not yet have a CVE identifier. Those are listed by their GitHub Security Advisory (GHSA) ID instead. The advisories are published on the MariaDB Server GitHub Security Advisories page, and a CVE identifier is added once assigned.

Advisory (CVE or GHSA)
CVSS base score (v3.1)

CVE-2026-34303

6.5

CVE-2026-47023

4.9

CVE-2026-60184

4.4

CVE-2026-60331

6.4

CVE-2026-60585

6.6

CVE-2026-60747

6.2

CVE-2026-61081

2.7

CVE-2026-85745

4.3

CVE-2026-85746

9.9

CVE-2026-85748

9.9

CVE-2026-85985

5.4

CVE-2026-86047

7.7

CVE-2026-92262

9.9

GHSA-65jj-h265-3m7h

9.9

GHSA-625w-4hgq-qwmr

8.8

GHSA-h4vr-wpff-jfx4

8.0

GHSA-g2q2-3936-cp37

7.2

GHSA-2m85-2x26-36rf

6.4

GHSA-c4gx-34mg-95q5

8.0

GHSA-fmq9-qjxj-qpf7

5.9

GHSA-mhvc-vqcq-7vq5

8.4

GHSA-4wgx-ffg9-jrwq

8.5

GHSA-wfqg-88r5-55f6

6.4

GHSA-89ph-64cf-gqcc

4.4

Full list of Fixed Security Vulnerabilities in MariaDB Enterprise Server

Changes in Storage Engines

  • This release incorporates MariaDB ColumnStore engine version 25.10.6

Notable Changes

  • State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). (MDEV-23744)

    • Eight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.

    • Joiner (TLS server) role:

      • ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.

      • ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.

      • ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.

      • ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.

    • Donor (TLS client) role:

      • ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.

      • ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.

      • ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.

      • ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.

    • These are SST options read by the wsrep_sst_* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.

  • When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. (MDEV-28233)

  • Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly (MDEV-28239)

  • MariaDB RPM packages create a dedicated mysql user to run mariadbd; the home directory for this user has changed from the data directory to /nonexistent, which does not exist, so that a malicious user with the FILE privilege cannot create various dot-files in the home directory ($HOME); for example, a .bash_profile created there would be executed by su - mysql -s /bin/bash; upgrading an existing installation also resets the home directory

    • MariaDB deb packages (Debian and Ubuntu) are unaffected, because their home directory is already set to /nonexistent

Issues Fixed

Can result in data loss

  • REPAIR command on ARCHIVE table destroys TEXT Data (MDEV-24245)

  • Fixed memory corruption that could occur when updating a COMPRESSED column to a substring of its own value (e.g. UPDATE t SET c = RIGHT(c, n) or SUBSTRING(c, n)), when the column's current value is short enough to be stored uncompressed (below column_compression_threshold, default 100 bytes). (MDEV-39450)

  • Single quote in DATA DIRECTORY breaks SHOW CREATE TABLE (MDEV-40159)

  • Fix memory disclosure (if not a crash) with v2 Rows Events with truncated extra data (MDEV-39485, MENT-2842)

Can result in hang or crash

  • Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition (MDEV-31808)

  • Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer (MDEV-38843)

  • Some race conditions were fixed in the INFORMATION_SCHEMA views innodb_trx, innodb_locks, innodb_lock_waits (MDEV-39344)

  • One-byte OOB write in PROXY protocol v1 header parser (MDEV-39564)

  • ASAN crash on invalid proxy_protocol_networks value (MDEV-39658)

  • group_concat ignores max_allowed_packet (MDEV-39673)

  • Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated Table_map_log_event metadata, so a slave or mariadb-binlog --print-table-metadata now handle malformed table map events safely instead of crashing or leaking heap memory (MDEV-39689)

  • ExtractValue does not control recursion depth (MDEV-39750)

  • ST_GeomFromGeoJSON in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. (MDEV-39813)

  • MyISAM crash on corrupted MYI with invalid keyseg length (MDEV-39816)

  • Bundled command-line clients don't always enforce length limits on server results (MDEV-40065)

  • Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs (MDEV-40298)

  • ASAN error on malformed WKB multipolygon (MDEV-40328)

  • #mysql50# mixes up with table names in the table cache and on disk (MDEV-40362)

  • ST_GeomFromText stack overrun on deeply nested GeometryCollection (MDEV-40409)

  • A replica could crash on connecting to a master whose binlog_checksum setting differs from the setting in effect when the replica's relay log was written, if the master's binary log file name was longer than a file name may legally be; the replica did not check the length of the file name the master reported before storing it, so an overlong name corrupted the replica's memory; the replica now rejects the over-sized name and stops its IO thread with an error, instead of crashing (MDEV-40492)

  • ST_GeomFromWKB stack overrun on deeply nested GeometryCollection (MDEV-40540)

  • insufficient validation of frm data when opening a table (MDEV-40571)

  • A replica could crash when its master sent a row event carrying a database or table name longer than MariaDB allows an identifier to be, which indicates a corrupted or forged event; the replica copied the name into storage sized for a legal identifier without checking the length it was given; such an event now stops the replica's SQL thread with a replication error instead of crashing the replica (MDEV-40644)

  • A replica could crash, or copy unrelated memory into its own record of a replicated table's structure, when a row event described more columns than its accompanying column information covered; the replica accepted the event based on a size check too weak to catch the shortfall, then read column information the event did not contain; the replica now verifies that the event carries column information for every column it declares, and stops the SQL thread with a replication error when it does not (MDEV-40646)

  • The file_key_management plugin can crash if the key file is empty (MDEV-40658)

  • A large number of joins in a SELECT can crash the server (MENT-2788)

  • cached_sha2_password crashes on zero-length password (MDEV-40058, MENT-2804)

  • Fix crash on Format Description event with incomplete contents (MDEV-40365, MENT-2840)

  • Fix crash on Format Description event with incomplete contents (MDEV-40366, MENT-2841)

  • A replica could crash when a heartbeat or other event from its master arrived truncated, which can happen when the replication stream is corrupted in transit; the replica trusted the size the truncated event declared and tried to read and allocate far more data than the event held, in some builds nearly 4GB; such an event now stops the replica's IO thread with an error identifying the bad event length (MENT-2846)

  • Cherry pick MDEV-40645 - Slave Crash on Malformed User_var_log_event (MENT-2847)

Can result in unexpected behaviour

  • Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds (MDEV-35812)

  • Deleting from Aria table could result in a corrupt index on Windows (MDEV-37000)

  • Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) (MDEV-39047)

  • missing filename check in mariadb-backup --decompress (MDEV-39565)

  • PROXY v2 protocol uninitialized memory reads (MDEV-39576)

  • dynamic column header missing sanity checks (MDEV-39581)

  • ASAN error on malformed WKB point (MDEV-39657)

  • SHOW CREATE TABLE corrupts `-quoted table options (MDEV-39776)

  • 32-bit size truncation in RocksDB (MDEV-39812)

  • JSON_ARRAYAGG() returns garbage because of off-by-one error (MDEV-39817)

  • Backtick in FK names breaks SHOW CREATE TABLE (MDEV-39818)

  • Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter (MDEV-40200)

  • single quotes make SHOW CREATE USER invalid (MDEV-40308)

  • mariadb-dump doesn't always quote identifiers (MDEV-40311)

  • symlinked table name is not encoded (MDEV-40358)

  • MyISAM/Aria silently truncate extensions from filenames, if too long (MDEV-40395)

  • GRANT PROXY with empty password incorrectly checks grantor's privileges (MDEV-40470)

  • Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated (MDEV-40484)

  • mysql_json plugin OOB reads (MDEV-40678)

  • DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv (MDEV-40722)

  • ALTER TABLE ... CONVERT ... PARTITION doesn't encode partition names (MDEV-40413, MENT-2799)

  • Fix crash in Rotate event when followed by a Format Description event describing no Rotate event support (MDEV-40647, MENT-2848)

  • A master could cause a replica to apply the same statement twice and end up with data the master's binary log never contained, by sending an event whose declared size disagrees with the amount of data actually sent; the replica stored such an event in its relay log as received, and a hidden second event in the surplus bytes was later applied as though the master had sent it; the replica now compares the two sizes on arrival, so a mismatched event stops the IO thread with an error and never reaches the relay log; this closes a gap that made a replica's data unverifiable against its master's binary log (MENT-2849)

Related to install and upgrade

  • Provide fallback message logging function when they are not present (MDEV-38075)

  • mariadb_upgrade running when upgrading from community server to same major version of enterprise server (MENT-1712)

Related to performance

  • Hashicorp Key Management plugin improved performance by avoiding calling expensive time retrieval functions (MDEV-37187)

Unexpected results

  • JSON functions on large input; JSON_CONTAIN, JSON_CONTAINS_PATH, JSON_EXISTS, JSON_EXTRACT, and JSON_KEYS; were previously uninterruptible with KILL query, and could exceed their maximum query time (MDEV-28404)

  • JSON_EXISTS was permitted to exceeded the depth for JSON functions (MDEV-39276)

  • Remove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691)

  • ST_GEOMFROMGEOJSON when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object (MDEV-39981)

  • qc_info OOB read if query contains \0 (MDEV-40670)

Changelog

For the complete list of changes in this release, see the changelog.

Platforms

In alignment to the enterprise lifecycle, MariaDB Enterprise Server 10.6.28-24 is provided for:

  • AlmaLinux 8 (x86_64, ARM64)

  • AlmaLinux 9 (x86_64, ARM64)

  • Debian 11 (x86_64, ARM64)

  • Debian 12 (x86_64, ARM64)

  • Oracle Linux 8 (x86_64, ARM64)

  • Oracle Linux 9 (x86_64, ARM64)

  • Red Hat Enterprise Linux 8 (x86_64, ARM64)

  • Red Hat Enterprise Linux 9 (x86_64, ARM64, PPC64LE)

  • Rocky Linux 8 (x86_64, ARM64)

  • Rocky Linux 9 (x86_64, ARM64)

  • SUSE Linux Enterprise Server 12 (x86_64)

  • SUSE Linux Enterprise Server 15 (x86_64, ARM64)

  • Ubuntu 22.04 (x86_64, ARM64)

  • Ubuntu 24.04 (x86_64, ARM64)

  • Microsoft Windows (x86_64) (Without MariaDB Enterprise Cluster (Galera) support)

  • Red Hat UBI 8 (x86_64, ARM64)

    • Red Hat UBI 8 is part of the Enterprise Server Docker Image. It does not support MariaDB Enterprise Cluster (Galera) or MariaDB ColumnStore.

Some components of MariaDB Enterprise Server are supported on a subset of platforms. See MariaDB Engineering Policies for details.

Installation Instructions

Upgrade Instructions

This page is: Copyright © 2026 MariaDB. All rights reserved.

spinner
PreviousWhat's New in MariaDB Enterprise Server 10.6?
NextRelease Notes for MariaDB Enterprise Server 10.6.27-23

Last updated

Was this helpful?