> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/enterprise-server/10.6/changelog-10.6.28-24.md).

# Changelog for MariaDB Enterprise Server 10.6.28-24

MariaDB Enterprise Server 10.6.28-24 is a Stable (GA) maintenance release of MariaDB Enterprise Server 10.6, released on 2026-09-07

<a href="https://mariadb.com/downloads/enterprise/enterprise-server/" class="button primary">Download</a> <a href="/docs/release-notes/enterprise-server/10.6/10.6.28-24.md" class="button secondary">Release Notes</a> <a class="button secondary">Changelog</a> <a href="/docs/release-notes/enterprise-server/10.6/whats-new.md" class="button secondary">Overview of Enterprise Server 10.6</a>

**Release date:** 7 Sep 2026

## Issues Fixed

### Issues Fixed

* State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). ([MDEV-23744](https://jira.mariadb.org/browse/MDEV-23744))
  * Eight new options are added, read from the \[sst] (or \[mysqld]) option group. Each one overrides the corresponding generic ssl-\* option for its role when set; when it is not set, the generic ssl-\* option is used, so existing configurations behave exactly as before.
  * Joiner (TLS server) role:
    * ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * Donor (TLS client) role:
    * ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * These are SST options read by the wsrep\_sst\_\* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
* When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. ([MDEV-28233](https://jira.mariadb.org/browse/MDEV-28233))
* Galera state transfers (SST) now interpret the ssl-mode=VERIFY\_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, VERIFY\_CA was incorrectly treated as strictly as VERIFY\_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY\_IDENTITY explicitly ([MDEV-28239](https://jira.mariadb.org/browse/MDEV-28239))
* JSON functions on large input; JSON\_CONTAIN, JSON\_CONTAINS\_PATH, JSON\_EXISTS, JSON\_EXTRACT, and JSON\_KEYS; were previously uninterruptible with KILL query, and could exceed their maximum query time ([MDEV-28404](https://jira.mariadb.org/browse/MDEV-28404))
* Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds ([MDEV-35812](https://jira.mariadb.org/browse/MDEV-35812))
* server crash hp\_rec\_key\_cmp ([MDEV-38722](https://jira.mariadb.org/browse/MDEV-38722))
* Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated Table\_map\_log\_event metadata, so a slave or mariadb-binlog --print-table-metadata now handle malformed table map events safely instead of crashing or leaking heap memory; thanks to Luke Lu of AWS for providing this fix ([MDEV-39689](https://jira.mariadb.org/browse/MDEV-39689))
* ExtractValue does not control recursion depth ([MDEV-39750](https://jira.mariadb.org/browse/MDEV-39750))
* SHOW CREATE TABLE corrupts \`-quoted table options ([MDEV-39776](https://jira.mariadb.org/browse/MDEV-39776))
* ST\_GeomFromGeoJSON in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. ([MDEV-39813](https://jira.mariadb.org/browse/MDEV-39813))
* backtick in FK names breaks SHOW CREATE TABLE ([MDEV-39818](https://jira.mariadb.org/browse/MDEV-39818))
* bundled command-line clients don't always enforce length limits on server results ([MDEV-40065](https://jira.mariadb.org/browse/MDEV-40065))
* single quote in DATA DIRECTORY breaks SHOW CREATE TABLE ([MDEV-40159](https://jira.mariadb.org/browse/MDEV-40159))
* Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs ([MDEV-40298](https://jira.mariadb.org/browse/MDEV-40298))
* single quotes make SHOW CREATE USER invalid ([MDEV-40308](https://jira.mariadb.org/browse/MDEV-40308))
* mariadb-dump doesn't always quote identifiers ([MDEV-40311](https://jira.mariadb.org/browse/MDEV-40311))
* CONNECT file udfs ignore FILE and secure\_file\_priv ([MDEV-40323](https://jira.mariadb.org/browse/MDEV-40323))
* Binary\_string::qs\_append(char): Assertion \`str\_length + (uint32) (1) <= Alloced\_length' failed in AsText ([MDEV-40329](https://jira.mariadb.org/browse/MDEV-40329))
* \#mysql50# mixes up with table names in the table cache and on disk ([MDEV-40362](https://jira.mariadb.org/browse/MDEV-40362))
* GRANT PROXY with empty password incorrectly checks grantor's privileges ([MDEV-40470](https://jira.mariadb.org/browse/MDEV-40470))
* role vs user\@localhost acl\_cache key confusion ([MDEV-40541](https://jira.mariadb.org/browse/MDEV-40541))
* insufficient validation of frm data when opening a table ([MDEV-40571](https://jira.mariadb.org/browse/MDEV-40571))
* It was possible for a user with FILE privileges and a secure\_file\_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. ([MDEV-40629](https://jira.mariadb.org/browse/MDEV-40629))
* The stunnel is a dependency of the Galera rsync sst mechanism. Its optional until a TLS configuration is applied for the SST mechanism. Added stunnel as a recommended package for RPMs and Debian packages for MariaDB-server and in 12.3, a required package of MariaDB-server-galera. ([MDEV-40630](https://jira.mariadb.org/browse/MDEV-40630))
* When running a DELETE on a table which is using the CSV storage engine, the server can crash ([MDEV-40636](https://jira.mariadb.org/browse/MDEV-40636))
* mysql\_json plugin OOB reads ([MDEV-40678](https://jira.mariadb.org/browse/MDEV-40678))
* DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs\_priv ([MDEV-40722](https://jira.mariadb.org/browse/MDEV-40722))
* Hashicorp Key Management plugin improved performance by avoiding calling expensive time retrieval functions ([MENT-2764](https://jira.mariadb.org/browse/MENT-2764))
* A large number of joins in a SELECT can crash the server ([MENT-2788](https://jira.mariadb.org/browse/MENT-2788))
* Backport MDEV-40413 - ALTER TABLE ... CONVERT ... PARTITION doesn't encode partition names ([MENT-2799](https://jira.mariadb.org/browse/MENT-2799))
* Backport MDEV-40058 - cached\_sha2\_password crashes on zero-length password ([MENT-2804](https://jira.mariadb.org/browse/MENT-2804))
* Backport MDEV-40365 - OOB read for common\_header\_len & post\_header\_len on malformed Format\_description\_log\_event ([MENT-2840](https://jira.mariadb.org/browse/MENT-2840))
* Backport MDEV-40366 - OOB read for used\_checksum\_alg on malformed Format\_description\_log\_event ([MENT-2841](https://jira.mariadb.org/browse/MENT-2841))
* Backport MDEV-39485 - Heap-buffer-overflow in mariadb-binlog upon read in Rows\_log\_event constructor in sql/log\_event.cc ([MENT-2842](https://jira.mariadb.org/browse/MENT-2842))
* A replica could crash when a heartbeat or other event from its master arrived truncated, which can happen when the replication stream is corrupted in transit; the replica trusted the size the truncated event declared and tried to read and allocate far more data than the event held, in some builds nearly 4GB; such an event now stops the replica's IO thread with an error identifying the bad event length ([MENT-2846](https://jira.mariadb.org/browse/MENT-2846))
* Cherry pick MDEV-40645 - Slave Crash on Malformed User\_var\_log\_event ([MENT-2847](https://jira.mariadb.org/browse/MENT-2847))
* Backport MDEV-40647 - Replication Breaks from Mal-copied Binlog Name on Malformed Format\_description Event ([MENT-2848](https://jira.mariadb.org/browse/MENT-2848))
* A master could cause a replica to apply the same statement twice and end up with data the master's binary log never contained, by sending an event whose declared size disagrees with the amount of data actually sent; the replica stored such an event in its relay log as received, and a hidden second event in the surplus bytes was later applied as though the master had sent it; the replica now compares the two sizes on arrival, so a mismatched event stops the IO thread with an error and never reaches the relay log; this closes a gap that made a replica's data unverifiable against its master's binary log ([MENT-2849](https://jira.mariadb.org/browse/MENT-2849))
* Deleting from Aria table could result in a corrupt index on Windows ([MDEV-37000](https://jira.mariadb.org/browse/MDEV-37000))
* JSON\_EXISTS was permitted to exceeded the depth for JSON functions ([MDEV-39276](https://jira.mariadb.org/browse/MDEV-39276))
* Fixed memory corruption that could occur when updating a COMPRESSED column to a substring of its own value (e.g. UPDATE t SET c = RIGHT(c, n) or SUBSTRING(c, n)), when the column's current value is short enough to be stored uncompressed (below column\_compression\_threshold, default 100 bytes). ([MDEV-39450](https://jira.mariadb.org/browse/MDEV-39450))
* Remove deprecated wsrep\_causal\_reads as a configuration option from provided wsrep.cnf ([MDEV-39691](https://jira.mariadb.org/browse/MDEV-39691))
* ASAN error on malformed WKB multipolygon ([MDEV-40328](https://jira.mariadb.org/browse/MDEV-40328))
* MyISAM/Aria silently truncate extensions from filenames, if too long ([MDEV-40395](https://jira.mariadb.org/browse/MDEV-40395))
* ST\_GeomFromText stack overrun on deeply nested GeometryCollection ([MDEV-40409](https://jira.mariadb.org/browse/MDEV-40409))
* ST\_GeomFromWKB stack overrun on deeply nested GeometryCollection ([MDEV-40540](https://jira.mariadb.org/browse/MDEV-40540))
* mariadb\_upgrade running when upgrading from community server to same major version of enterprise server ([MENT-1712](https://jira.mariadb.org/browse/MENT-1712))
* REPAIR command on ARCHIVE table destroys TEXT Data ([MDEV-24245](https://jira.mariadb.org/browse/MDEV-24245))
* On big-endian platforms, the interruption of the execution of JSON functions was previously not possible and this is now corrected; on all platforms the interruption of JSON\_OVERLAPS now returns the correct error code ([MDEV-30518](https://jira.mariadb.org/browse/MDEV-30518))
* Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition ([MDEV-31808](https://jira.mariadb.org/browse/MDEV-31808))
* Provide fallback message logging function when they are not present ([MDEV-38075](https://jira.mariadb.org/browse/MDEV-38075))
* Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer ([MDEV-38843](https://jira.mariadb.org/browse/MDEV-38843))
* Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) ([MDEV-39047](https://jira.mariadb.org/browse/MDEV-39047))
* Some race conditions were fixed in the INFORMATION\_SCHEMA views innodb\_trx, innodb\_locks, innodb\_lock\_waits. ([MDEV-39344](https://jira.mariadb.org/browse/MDEV-39344))
* Assertion \`n\_fields > n\_cols || type & 32' failed in dict\_index\_t::init\_change\_cols on ALTER ([MDEV-39448](https://jira.mariadb.org/browse/MDEV-39448))
* Changing a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash ([MDEV-39556](https://jira.mariadb.org/browse/MDEV-39556))
* One-byte OOB write in PROXY protocol v1 header parser ([MDEV-39564](https://jira.mariadb.org/browse/MDEV-39564))
* missing filename check in mariadb-backup --decompress ([MDEV-39565](https://jira.mariadb.org/browse/MDEV-39565))
* PROXY v2 protocol uninitialized memory reads ([MDEV-39576](https://jira.mariadb.org/browse/MDEV-39576))
* dynamic column header missing sanity checks ([MDEV-39581](https://jira.mariadb.org/browse/MDEV-39581))
* ASAN error on malformed WKB point ([MDEV-39657](https://jira.mariadb.org/browse/MDEV-39657))
* ASAN crash on invalid proxy\_protocol\_networks value ([MDEV-39658](https://jira.mariadb.org/browse/MDEV-39658))
* group\_concat ignores max\_allowed\_packet ([MDEV-39673](https://jira.mariadb.org/browse/MDEV-39673))
* 32-bit size truncation in RocksDB ([MDEV-39812](https://jira.mariadb.org/browse/MDEV-39812))
* MyISAM crash on corrupted MYI with invalid keyseg length ([MDEV-39816](https://jira.mariadb.org/browse/MDEV-39816))
* JSON\_ARRAYAGG() returns garbage because of off-by-one error ([MDEV-39817](https://jira.mariadb.org/browse/MDEV-39817))
* `ST_GEOMFROMGEOJSON` when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object, thanks to Akshat Nehra of AWS for providing a solution to this ([MDEV-39981](https://jira.mariadb.org/browse/MDEV-39981))
* Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter; fix thanks to Syed Mohammed Nayyar ([MDEV-40200](https://jira.mariadb.org/browse/MDEV-40200))
* Fix Static Application Security Testing(SAST) warnings in Connect storage engine ([MDEV-40316](https://jira.mariadb.org/browse/MDEV-40316))
* symlinked table name is not encoded ([MDEV-40358](https://jira.mariadb.org/browse/MDEV-40358))
* CONNECT REST can pass arguments to curl via HTTP parameter ([MDEV-40360](https://jira.mariadb.org/browse/MDEV-40360))
* CONNECT writes unvalidated data from remote server into fixed-len buffer ([MDEV-40426](https://jira.mariadb.org/browse/MDEV-40426))
* Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated ([MDEV-40484](https://jira.mariadb.org/browse/MDEV-40484))
* CONNECT crashes on double(255,50) in DOS table ([MDEV-40637](https://jira.mariadb.org/browse/MDEV-40637))
* The file\_key\_management plugin can crash if the key file is empty ([MDEV-40658](https://jira.mariadb.org/browse/MDEV-40658))
* qc\_info OOB read if query contains \0 ([MDEV-40670](https://jira.mariadb.org/browse/MDEV-40670))
* UDF: CWE-400 (Uncontrolled Resource Consumption) ([MDEV-40345](https://jira.mariadb.org/browse/MDEV-40345))

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}