Changelog for MariaDB Enterprise Server 10.6.28-24
MariaDB Enterprise Server 10.6.28-24 is a Stable (GA) maintenance release of MariaDB Enterprise Server 10.6, released on 2026-09-07
Release date: 7 Sep 2026
Issues Fixed
Issues Fixed
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). (MDEV-23744)
Eight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.
Joiner (TLS server) role:
ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
Donor (TLS client) role:
ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
These are SST options read by the wsrep_sst_* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. (MDEV-28233)
Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly (MDEV-28239)
JSON functions on large input; JSON_CONTAIN, JSON_CONTAINS_PATH, JSON_EXISTS, JSON_EXTRACT, and JSON_KEYS; were previously uninterruptible with KILL query, and could exceed their maximum query time (MDEV-28404)
Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds (MDEV-35812)
server crash hp_rec_key_cmp (MDEV-38722)
Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated Table_map_log_event metadata, so a slave or mariadb-binlog --print-table-metadata now handle malformed table map events safely instead of crashing or leaking heap memory; thanks to Luke Lu of AWS for providing this fix (MDEV-39689)
ExtractValue does not control recursion depth (MDEV-39750)
SHOW CREATE TABLE corrupts `-quoted table options (MDEV-39776)
ST_GeomFromGeoJSON in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. (MDEV-39813)
backtick in FK names breaks SHOW CREATE TABLE (MDEV-39818)
bundled command-line clients don't always enforce length limits on server results (MDEV-40065)
single quote in DATA DIRECTORY breaks SHOW CREATE TABLE (MDEV-40159)
Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs (MDEV-40298)
single quotes make SHOW CREATE USER invalid (MDEV-40308)
mariadb-dump doesn't always quote identifiers (MDEV-40311)
CONNECT file udfs ignore FILE and secure_file_priv (MDEV-40323)
Binary_string::qs_append(char): Assertion `str_length + (uint32) (1) <= Alloced_length' failed in AsText (MDEV-40329)
#mysql50# mixes up with table names in the table cache and on disk (MDEV-40362)
GRANT PROXY with empty password incorrectly checks grantor's privileges (MDEV-40470)
A replica could crash on connecting to a master whose binlog_checksum setting differs from the setting in effect when the replica's relay log was written, if the master's binary log file name was longer than a file name may legally be; the replica did not check the length of the file name the master reported before storing it, so an overlong name corrupted the replica's memory; the replica now rejects the over-sized name and stops its IO thread with an error, instead of crashing (MDEV-40492)
role vs user@localhost acl_cache key confusion (MDEV-40541)
insufficient validation of frm data when opening a table (MDEV-40571)
It was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. (MDEV-40629)
stunnel is a dependency of the Galera rsync SST mechanism; it is optional until a TLS configuration is applied for the SST mechanism; stunnel is now a recommended package of the MariaDB-server RPM and the mariadb-server-10.6 DEB (MDEV-40630)
When running a DELETE on a table which is using the CSV storage engine, the server can crash (MDEV-40636)
A replica could crash when its master sent a row event carrying a database or table name longer than MariaDB allows an identifier to be, which indicates a corrupted or forged event; the replica copied the name into storage sized for a legal identifier without checking the length it was given; such an event now stops the replica's SQL thread with a replication error instead of crashing the replica (MDEV-40644)
A replica could crash, or copy unrelated memory into its own record of a replicated table's structure, when a row event described more columns than its accompanying column information covered; the replica accepted the event based on a size check too weak to catch the shortfall, then read column information the event did not contain; the replica now verifies that the event carries column information for every column it declares, and stops the SQL thread with a replication error when it does not (MDEV-40646)
mysql_json plugin OOB reads (MDEV-40678)
DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv (MDEV-40722)
Hashicorp Key Management plugin improved performance by avoiding calling expensive time retrieval functions (MENT-2764)
A large number of joins in a SELECT can crash the server (MENT-2788)
ALTER TABLE ... CONVERT ... PARTITIONdoesn't encode partition names (MDEV-40413, MENT-2799)Authenticating with the caching_sha2_password plugin over a connection without TLS, using its RSA key exchange, could crash the server if the encrypted packet decrypted to a zero-length password; such a password is now rejected as an authentication failure instead of crashing the server. (MENT-2804)
Backport MDEV-40365 - OOB read for common_header_len & post_header_len on malformed Format_description_log_event (MENT-2840)
Backport MDEV-40366 - OOB read for used_checksum_alg on malformed Format_description_log_event (MENT-2841)
Backport MDEV-39485 - Heap-buffer-overflow in mariadb-binlog upon read in Rows_log_event constructor in sql/log_event.cc (MENT-2842)
A replica could crash when a heartbeat or other event from its master arrived truncated, which can happen when the replication stream is corrupted in transit; the replica trusted the size the truncated event declared and tried to read and allocate far more data than the event held, in some builds nearly 4GB; such an event now stops the replica's IO thread with an error identifying the bad event length (MENT-2846)
Cherry pick MDEV-40645 - Slave Crash on Malformed User_var_log_event (MENT-2847)
Backport MDEV-40647 - Replication Breaks from Mal-copied Binlog Name on Malformed Format_description Event (MENT-2848)
A master could cause a replica to apply the same statement twice and end up with data the master's binary log never contained, by sending an event whose declared size disagrees with the amount of data actually sent; the replica stored such an event in its relay log as received, and a hidden second event in the surplus bytes was later applied as though the master had sent it; the replica now compares the two sizes on arrival, so a mismatched event stops the IO thread with an error and never reaches the relay log; this closes a gap that made a replica's data unverifiable against its master's binary log (MENT-2849)
Deleting from Aria table could result in a corrupt index on Windows (MDEV-37000)
JSON_EXISTS was permitted to exceeded the depth for JSON functions (MDEV-39276)
Fixed memory corruption that could occur when updating a COMPRESSED column to a substring of its own value (e.g. UPDATE t SET c = RIGHT(c, n) or SUBSTRING(c, n)), when the column's current value is short enough to be stored uncompressed (below column_compression_threshold, default 100 bytes). (MDEV-39450)
Remove deprecated wsrep_causal_reads as a configuration option from provided wsrep.cnf (MDEV-39691)
ASAN error on malformed WKB multipolygon (MDEV-40328)
MyISAM/Aria silently truncate extensions from filenames, if too long (MDEV-40395)
ST_GeomFromText stack overrun on deeply nested GeometryCollection (MDEV-40409)
ST_GeomFromWKB stack overrun on deeply nested GeometryCollection (MDEV-40540)
mariadb_upgrade running when upgrading from community server to same major version of enterprise server (MENT-1712)
REPAIR command on ARCHIVE table destroys TEXT Data (MDEV-24245)
On big-endian platforms, the interruption of the execution of JSON functions was previously not possible and this is now corrected; on all platforms the interruption of JSON_OVERLAPS now returns the correct error code (MDEV-30518)
Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition (MDEV-31808)
Provide fallback message logging function when they are not present (MDEV-38075)
Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer (MDEV-38843)
Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) (MDEV-39047)
Some race conditions were fixed in the INFORMATION_SCHEMA views innodb_trx, innodb_locks, innodb_lock_waits. (MDEV-39344)
Assertion `n_fields > n_cols || type & 32' failed in dict_index_t::init_change_cols on ALTER (MDEV-39448)
Changing a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash (MDEV-39556)
One-byte OOB write in PROXY protocol v1 header parser (MDEV-39564)
missing filename check in mariadb-backup --decompress (MDEV-39565)
PROXY v2 protocol uninitialized memory reads (MDEV-39576)
dynamic column header missing sanity checks (MDEV-39581)
ASAN error on malformed WKB point (MDEV-39657)
ASAN crash on invalid proxy_protocol_networks value (MDEV-39658)
group_concat ignores max_allowed_packet (MDEV-39673)
32-bit size truncation in RocksDB (MDEV-39812)
MyISAM crash on corrupted MYI with invalid keyseg length (MDEV-39816)
JSON_ARRAYAGG() returns garbage because of off-by-one error (MDEV-39817)
ST_GEOMFROMGEOJSONwhen passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object, thanks to Akshat Nehra of AWS for providing a solution to this (MDEV-39981)Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter; fix thanks to Syed Mohammed Nayyar (MDEV-40200)
Fix Static Application Security Testing(SAST) warnings in Connect storage engine (MDEV-40316)
symlinked table name is not encoded (MDEV-40358)
CONNECT REST can pass arguments to curl via HTTP parameter (MDEV-40360)
CONNECT writes unvalidated data from remote server into fixed-len buffer (MDEV-40426)
Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated (MDEV-40484)
CONNECT crashes on double(255,50) in DOS table (MDEV-40637)
The file_key_management plugin can crash if the key file is empty (MDEV-40658)
qc_info OOB read if query contains \0 (MDEV-40670)
UDF: CWE-400 (Uncontrolled Resource Consumption) (MDEV-40345)
This page is: Copyright © 2026 MariaDB. All rights reserved.
Last updated
Was this helpful?