> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/enterprise-server/10.6/10.6.28-24.md).

# Release Notes for MariaDB Enterprise Server 10.6.28-24

<a href="https://mariadb.com/downloads/enterprise/enterprise-server/" class="button primary">Download</a> <a class="button secondary">Release Notes</a> <a href="/pages/fuombwtl81uokhclKmMC" class="button secondary">Changelog</a> <a href="/pages/mZdNhdcxviKVkn3MStsY" class="button secondary">Overview of Enterprise Server 10.6</a>

**Release date:** 7 Sep 2026

MariaDB Enterprise Server 10.6.28-24 is a Stable (GA) maintenance release of [MariaDB Enterprise Server 10.6](/docs/release-notes/enterprise-server/10.6/whats-new.md). This release includes a variety of fixes.

{% hint style="success" %}

<p align="center"><strong>See</strong> <a href="/pages/mZdNhdcxviKVkn3MStsY"><strong>what's new in MariaDB Enterprise Server 10.6</strong></a></p>
{% endhint %}

## Fixed Security Vulnerabilities <a href="#fixed-security-vulnerabilities" id="fixed-security-vulnerabilities"></a>

Some of these issues do not yet have a CVE identifier. Those are listed by their GitHub Security Advisory (GHSA) ID instead. The advisories are published on the [MariaDB Server GitHub Security Advisories page](https://github.com/MariaDB/server/security/advisories), and a CVE identifier is added once assigned.

| Advisory (CVE or GHSA)                                            | CVSS base score (v3.1) |
| ----------------------------------------------------------------- | ---------------------- |
| [CVE-2026-47023](https://www.cve.org/CVERecord?id=CVE-2026-47023) | 4.9                    |
| [CVE-2026-60184](https://www.cve.org/CVERecord?id=CVE-2026-60184) | 4.4                    |
| [CVE-2026-60331](https://www.cve.org/CVERecord?id=CVE-2026-60331) | 6.4                    |
| [CVE-2026-60585](https://www.cve.org/CVERecord?id=CVE-2026-60585) | 6.6                    |
| [CVE-2026-60747](https://www.cve.org/CVERecord?id=CVE-2026-60747) | 6.2                    |
| [CVE-2026-61081](https://www.cve.org/CVERecord?id=CVE-2026-61081) | 2.7                    |
| [CVE-2026-85745](https://www.cve.org/CVERecord?id=CVE-2026-85745) | 4.3                    |
| [CVE-2026-85746](https://www.cve.org/CVERecord?id=CVE-2026-85746) | 9.9                    |
| [CVE-2026-85748](https://www.cve.org/CVERecord?id=CVE-2026-85748) | 9.9                    |
| [CVE-2026-85985](https://www.cve.org/CVERecord?id=CVE-2026-85985) | 5.4                    |
| [CVE-2026-86047](https://www.cve.org/CVERecord?id=CVE-2026-86047) | 7.7                    |
| GHSA-65jj-h265-3m7h                                               | 9.9                    |
| GHSA-625w-4hgq-qwmr                                               | 8.8                    |
| GHSA-h4vr-wpff-jfx4                                               | 8.0                    |
| GHSA-g2q2-3936-cp37                                               | 7.2                    |
| GHSA-2m85-2x26-36rf                                               | 6.4                    |
| GHSA-c4gx-34mg-95q5                                               | 8.0                    |
| GHSA-fmq9-qjxj-qpf7                                               | 5.9                    |
| GHSA-mhvc-vqcq-7vq5                                               | 8.4                    |
| GHSA-4wgx-ffg9-jrwq                                               | 8.5                    |
| GHSA-wfqg-88r5-55f6                                               | 6.4                    |
| GHSA-89ph-64cf-gqcc                                               | 4.4                    |

[<sup><mark style="color:$tint;">Full list of Fixed Security Vulnerabilities in MariaDB Enterprise Server<mark style="color:$tint;"></sup>](/docs/server/security/cve/enterprise-server.md)

## Changes in Storage Engines <a href="#changes-in-storage-engines" id="changes-in-storage-engines"></a>

* This release incorporates MariaDB ColumnStore engine version 25.10.6

## Notable Changes

* State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). ([MDEV-23744](https://jira.mariadb.org/browse/MDEV-23744))
  * Eight new options are added, read from the \[sst] (or \[mysqld]) option group. Each one overrides the corresponding generic ssl-\* option for its role when set; when it is not set, the generic ssl-\* option is used, so existing configurations behave exactly as before.
  * Joiner (TLS server) role:
    * ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * Donor (TLS client) role:
    * ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * These are SST options read by the `wsrep_sst_*` scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
* When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. ([MDEV-28233](https://jira.mariadb.org/browse/MDEV-28233))
* Galera state transfers (SST) now interpret the `ssl-mode=VERIFY_CA` setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, `VERIFY_CA` was incorrectly treated as strictly as `VERIFY_IDENTITY`, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set `ssl-mode=VERIFY_IDENTITY` explicitly ([MDEV-28239](https://jira.mariadb.org/browse/MDEV-28239))
* Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (`skip_name_resolve` is not set) ([MDEV-37556](https://jira.mariadb.org/browse/MDEV-37556))

## Issues Fixed

### Can result in data loss

* REPAIR command on ARCHIVE table destroys TEXT Data ([MDEV-24245](https://jira.mariadb.org/browse/MDEV-24245))
* Fixed memory corruption that could occur when updating a COMPRESSED column to a substring of its own value (e.g. `UPDATE t SET c = RIGHT(c, n)` or `SUBSTRING(c, n)`), when the column's current value is short enough to be stored uncompressed (below `column_compression_threshold`, default 100 bytes). ([MDEV-39450](https://jira.mariadb.org/browse/MDEV-39450))
* Single quote in `DATA DIRECTORY` breaks `SHOW CREATE TABLE` ([MDEV-40159](https://jira.mariadb.org/browse/MDEV-40159))
* Fix memory disclosure (if not a crash) with v2 Rows Events with truncated extra data ([MDEV-39485](https://jira.mariadb.org/browse/MDEV-39485), [MENT-2842](https://jira.mariadb.org/browse/MENT-2842))

### Can result in hang or crash

* Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition ([MDEV-31808](https://jira.mariadb.org/browse/MDEV-31808))
* Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer ([MDEV-38843](https://jira.mariadb.org/browse/MDEV-38843))
* Some race conditions were fixed in the `INFORMATION_SCHEMA` views `innodb_trx`, `innodb_locks`, `innodb_lock_waits` ([MDEV-39344](https://jira.mariadb.org/browse/MDEV-39344))
* One-byte OOB write in PROXY protocol v1 header parser ([MDEV-39564](https://jira.mariadb.org/browse/MDEV-39564))
* ASAN crash on invalid `proxy_protocol_networks` value ([MDEV-39658](https://jira.mariadb.org/browse/MDEV-39658))
* `group_concat` ignores `max_allowed_packet` ([MDEV-39673](https://jira.mariadb.org/browse/MDEV-39673))
* Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated `Table_map_log_event` metadata, so a slave or `mariadb-binlog --print-table-metadata` now handle malformed table map events safely instead of crashing or leaking heap memory ([MDEV-39689](https://jira.mariadb.org/browse/MDEV-39689))
* ExtractValue does not control recursion depth ([MDEV-39750](https://jira.mariadb.org/browse/MDEV-39750))
* `ST_GeomFromGeoJSON` in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. ([MDEV-39813](https://jira.mariadb.org/browse/MDEV-39813))
* MyISAM crash on corrupted MYI with invalid keyseg length ([MDEV-39816](https://jira.mariadb.org/browse/MDEV-39816))
* Bundled command-line clients don't always enforce length limits on server results ([MDEV-40065](https://jira.mariadb.org/browse/MDEV-40065))
* Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs ([MDEV-40298](https://jira.mariadb.org/browse/MDEV-40298))
* ASAN error on malformed WKB multipolygon ([MDEV-40328](https://jira.mariadb.org/browse/MDEV-40328))
* \#mysql50# mixes up with table names in the table cache and on disk ([MDEV-40362](https://jira.mariadb.org/browse/MDEV-40362))
* `ST_GeomFromText` stack overrun on deeply nested GeometryCollection ([MDEV-40409](https://jira.mariadb.org/browse/MDEV-40409))
* `ST_GeomFromWKB` stack overrun on deeply nested GeometryCollection ([MDEV-40540](https://jira.mariadb.org/browse/MDEV-40540))
* insufficient validation of frm data when opening a table ([MDEV-40571](https://jira.mariadb.org/browse/MDEV-40571))
* The `file_key_management` plugin can crash if the key file is empty ([MDEV-40658](https://jira.mariadb.org/browse/MDEV-40658))
* A large number of joins in a SELECT can crash the server ([MENT-2788](https://jira.mariadb.org/browse/MENT-2788))
* `cached_sha2_password` crashes on zero-length password ([MDEV-40058](https://jira.mariadb.org/browse/MDEV-40058), [MENT-2804](https://jira.mariadb.org/browse/MENT-2804))
* Fix crash on Format Description event with incomplete contents ([MDEV-40365](https://jira.mariadb.org/browse/MDEV-40365), [MENT-2840](https://jira.mariadb.org/browse/MENT-2840))
* Fix crash on Format Description event with incomplete contents ([MDEV-40366](https://jira.mariadb.org/browse/MDEV-40366), [MENT-2841](https://jira.mariadb.org/browse/MENT-2841))
* A replica could crash when a heartbeat or other event from its master arrived truncated, which can happen when the replication stream is corrupted in transit; the replica trusted the size the truncated event declared and tried to read and allocate far more data than the event held, in some builds nearly 4GB; such an event now stops the replica's IO thread with an error identifying the bad event length ([MENT-2846](https://jira.mariadb.org/browse/MENT-2846))
* Cherry pick MDEV-40645 - Slave Crash on Malformed `User_var_log_event` ([MENT-2847](https://jira.mariadb.org/browse/MENT-2847))

### Can result in unexpected behaviour

* Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds ([MDEV-35812](https://jira.mariadb.org/browse/MDEV-35812))
* Deleting from Aria table could result in a corrupt index on Windows ([MDEV-37000](https://jira.mariadb.org/browse/MDEV-37000))
* Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) ([MDEV-39047](https://jira.mariadb.org/browse/MDEV-39047))
* missing filename check in mariadb-backup --decompress ([MDEV-39565](https://jira.mariadb.org/browse/MDEV-39565))
* PROXY v2 protocol uninitialized memory reads ([MDEV-39576](https://jira.mariadb.org/browse/MDEV-39576))
* dynamic column header missing sanity checks ([MDEV-39581](https://jira.mariadb.org/browse/MDEV-39581))
* ASAN error on malformed WKB point ([MDEV-39657](https://jira.mariadb.org/browse/MDEV-39657))
* SHOW CREATE TABLE corrupts \`-quoted table options ([MDEV-39776](https://jira.mariadb.org/browse/MDEV-39776))
* 32-bit size truncation in RocksDB ([MDEV-39812](https://jira.mariadb.org/browse/MDEV-39812))
* `JSON_ARRAYAGG()` returns garbage because of off-by-one error ([MDEV-39817](https://jira.mariadb.org/browse/MDEV-39817))
* Backtick in FK names breaks `SHOW CREATE TABLE` ([MDEV-39818](https://jira.mariadb.org/browse/MDEV-39818))
* An appropriately privileged user (with `SUPER` or `SYSTEM_VARIABLES_ADMIN` privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable `wsrep_sst_auth`, which can be modified at runtime, were not properly sanitized when used to construct a shell command ([MDEV-40027](https://jira.mariadb.org/browse/MDEV-40027))
* An appropriately privileged user (with `SUPER` privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable `wsrep_node_address`, which can be modified at runtime, were not properly sanitized when used to construct a shell command ([MDEV-40056](https://jira.mariadb.org/browse/MDEV-40056))
* Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter ([MDEV-40200](https://jira.mariadb.org/browse/MDEV-40200))
* single quotes make SHOW CREATE USER invalid ([MDEV-40308](https://jira.mariadb.org/browse/MDEV-40308))
* mariadb-dump doesn't always quote identifiers ([MDEV-40311](https://jira.mariadb.org/browse/MDEV-40311))
* symlinked table name is not encoded ([MDEV-40358](https://jira.mariadb.org/browse/MDEV-40358))
* MyISAM/Aria silently truncate extensions from filenames, if too long ([MDEV-40395](https://jira.mariadb.org/browse/MDEV-40395))
* `GRANT PROXY` with empty password incorrectly checks grantor's privileges ([MDEV-40470](https://jira.mariadb.org/browse/MDEV-40470))
* Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated ([MDEV-40484](https://jira.mariadb.org/browse/MDEV-40484))
* `mysql_json` plugin OOB reads ([MDEV-40678](https://jira.mariadb.org/browse/MDEV-40678))
* `DROP PACKAGE` leaves `PACKAGE BODY` grant in `mysql.procs_priv` ([MDEV-40722](https://jira.mariadb.org/browse/MDEV-40722))
* `ALTER TABLE ... CONVERT ... PARTITION` doesn't encode partition names ([MDEV-40413](https://jira.mariadb.org/browse/MDEV-40413), [MENT-2799](https://jira.mariadb.org/browse/MENT-2799))
* Fix crash in Rotate event when followed by a Format Description event describing no Rotate event support ([MDEV-40647](https://jira.mariadb.org/browse/MDEV-40647), [MENT-2848](https://jira.mariadb.org/browse/MENT-2848))
* A master could cause a replica to apply the same statement twice and end up with data the master's binary log never contained, by sending an event whose declared size disagrees with the amount of data actually sent; the replica stored such an event in its relay log as received, and a hidden second event in the surplus bytes was later applied as though the master had sent it; the replica now compares the two sizes on arrival, so a mismatched event stops the IO thread with an error and never reaches the relay log; this closes a gap that made a replica's data unverifiable against its master's binary log ([MENT-2849](https://jira.mariadb.org/browse/MENT-2849))

### Related to install and upgrade

* Provide fallback message logging function when they are not present ([MDEV-38075](https://jira.mariadb.org/browse/MDEV-38075))
* `mariadb_upgrade` running when upgrading from community server to same major version of enterprise server ([MENT-1712](https://jira.mariadb.org/browse/MENT-1712))

### Related to performance

* Hashicorp Key Management plugin improved performance by avoiding calling expensive time retrieval functions ([MDEV-37187](https://jira.mariadb.org/browse/MDEV-37187))

### Unexpected results

* JSON functions on large input; `JSON_CONTAIN`, `JSON_CONTAINS_PATH`, `JSON_EXISTS`, `JSON_EXTRACT`, and `JSON_KEYS`; were previously uninterruptible with KILL query, and could exceed their maximum query time ([MDEV-28404](https://jira.mariadb.org/browse/MDEV-28404))
* `JSON_EXISTS` was permitted to exceeded the depth for JSON functions ([MDEV-39276](https://jira.mariadb.org/browse/MDEV-39276))
* Remove deprecated `wsrep_causal_reads` as a configuration option from provided wsrep.cnf ([MDEV-39691](https://jira.mariadb.org/browse/MDEV-39691))
* `ST_GEOMFROMGEOJSON` when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object ([MDEV-39981](https://jira.mariadb.org/browse/MDEV-39981))
* `qc_info` OOB read if query contains \0 ([MDEV-40670](https://jira.mariadb.org/browse/MDEV-40670))

## Changelog <a href="#changelog" id="changelog"></a>

For the complete list of changes in this release, see the [changelog](/docs/release-notes/enterprise-server/10.6/changelog-10.6.28-24.md).

## Platforms <a href="#platforms" id="platforms"></a>

In alignment to the enterprise lifecycle, MariaDB Enterprise Server 10.6.28-24 is provided for:

* AlmaLinux 8 (x86\_64, ARM64)
* AlmaLinux 9 (x86\_64, ARM64)
* Debian 11 (x86\_64, ARM64)
* Debian 12 (x86\_64, ARM64)
* Oracle Linux 8 (x86\_64, ARM64)
* Oracle Linux 9 (x86\_64, ARM64)
* Red Hat Enterprise Linux 8 (x86\_64, ARM64)
* Red Hat Enterprise Linux 9 (x86\_64, ARM64, PPC64LE)
* Rocky Linux 8 (x86\_64, ARM64)
* Rocky Linux 9 (x86\_64, ARM64)
* SUSE Linux Enterprise Server 12 (x86\_64)
* SUSE Linux Enterprise Server 15 (x86\_64, ARM64)
* Ubuntu 22.04 (x86\_64, ARM64)
* Ubuntu 24.04 (x86\_64, ARM64)
* Microsoft Windows (x86\_64) (Without MariaDB Enterprise Cluster (Galera) support)
* Red Hat UBI 8 (x86\_64, ARM64)
  * Red Hat UBI 8 is part of the Enterprise Server Docker Image. It does not support MariaDB Enterprise Cluster (Galera) or MariaDB ColumnStore.

Some components of MariaDB Enterprise Server are supported on a subset of platforms. See [MariaDB Engineering Policies](https://mariadb.com/engineering-policies) for details.

## Installation Instructions <a href="#installation-instructions" id="installation-instructions"></a>

* [Deploy MariaDB Enterprise with Repositories](/docs/server/server-management/install-and-upgrade-mariadb/mariadb-package-repository-setup-and-usage.md)
* [Deploy MariaDB Enterprise with Package Tarballs](/docs/server/server-management/install-and-upgrade-mariadb/installing-mariadb/binary-packages/package-tarballs.md)
* [Deploy MariaDB Enterprise with Docker](/docs/server/server-management/automated-mariadb-deployment-and-administration/docker-and-mariadb/deploy-mariadb-enterprise-server-with-docker.md)

## Upgrade Instructions <a href="#upgrade-instructions" id="upgrade-instructions"></a>

* [Upgrade to MariaDB Enterprise Server 10.6](/docs/server/server-management/install-and-upgrade-mariadb/upgrading/upgrade-paths/mariadb-enterprise-server-10.6/upgrade-to-mariadb-enterprise-server-10.6.md)

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}