See what's new in MariaDB Enterprise Server 11.4
{% endhint %} ## Fixed Security Vulnerabilities | CVE ID (with cve.org link) | CVSS base score (v3.1) | | ----------------------------------------------------------------- | ---------------------- | | [CVE-2026-3494](https://www.cve.org/CVERecord?id=CVE-2026-3494) | 4.3 | | [CVE-2026-44173](https://www.cve.org/CVERecord?id=CVE-2026-44173) | 5.0 | | [CVE-2026-44172](https://www.cve.org/CVERecord?id=CVE-2026-44172) | 5.0 | | [CVE-2026-44171](https://www.cve.org/CVERecord?id=CVE-2026-44171) | 6.3 | | [CVE-2026-44170](https://www.cve.org/CVERecord?id=CVE-2026-44170) | 5.0 | | [CVE-2026-44169](https://www.cve.org/CVERecord?id=CVE-2026-44169) | 4.3 | | [CVE-2026-44168](https://www.cve.org/CVERecord?id=CVE-2026-44168) | 8.0 | | [CVE-2026-48165](https://www.cve.org/CVERecord?id=CVE-2026-48165) | 8.0 | [Full list of Fixed Security Vulnerabilities in MariaDB Enterprise Server](/docs/server/security/cve/enterprise-server.md) ## Changes in Storage Engines * This release incorporates MariaDB ColumnStore engine version 25.10.5 ## Notable changes * [Galera](https://mariadb.com/docs/galera-cluster/) updated to 26.4.27 * Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (skip\_name\_resolve is not set) ([MENT-2685](https://jira.mariadb.org/browse/MENT-2685)) * For users without PROCESS privilege, SHOW PROCESSLIST and INFORMATION\_SCHEMA.PROCESSLIST will now show events running under the same user context. ([MDEV-34482](https://jira.mariadb.org/browse/MDEV-34482)) * When accessing a MEMORY table whose data is lost to restarting a *read-only* server *with replication connection(s) configured* for the first time, the automatically-generated TRUNCATE query in the Binary Log is now annotated with a comment and accompanied by a warning in the Error Log. ([MDEV-38600](https://jira.mariadb.org/browse/MDEV-38600)) * DROP PARTITION, CONVERT OUT require both ALTER and DROP privileges ([MDEV-39028](https://jira.mariadb.org/browse/MDEV-39028)) ## Issues Fixed ### Can result in data loss * Crash recovery may fail after a crash during an instant ALTER TABLE…PAGE\_COMPRESSED=1. Fix: make the operation rebuild the table. ([MDEV-38079](https://jira.mariadb.org/browse/MDEV-38079)) * Replica updates table to wrong values, further replication failures ([MDEV-38731](https://jira.mariadb.org/browse/MDEV-38731)) * Galera snapshot transfer with the default wsrep\_sst\_method=rsync could create corrupted backups when any InnoDB tables contain FULLTEXT INDEX. ([MDEV-32115](https://jira.mariadb.org/browse/MDEV-32115)) * Replication would break (or diverge) with STATEMENT binlog format when check\_constraint\_checks was modified from the configured startup value because the variable was not written to the binary log with the affected event. ([MDEV-32447](https://jira.mariadb.org/browse/MDEV-32447)) * Fixed issue when using ROWS EXAMINED with log\_out=TABLE This could, depending on version, cause a crash or having the next query aborting with 'empty result' ([MDEV-38683](https://jira.mariadb.org/browse/MDEV-38683)) ### Can result in hang or crash * Fixed a crash in InnoDB when processing long or encoded database names in Foreign Keys ([MDEV-24356](https://jira.mariadb.org/browse/MDEV-24356)) * Fixed a server crash that could occur during query optimization when a stored procedure queries a view containing CONCAT or GROUP\_CONCAT functions. ([MDEV-36678](https://jira.mariadb.org/browse/MDEV-36678)) * Warning: Memory not freed: 32" after server shutdown when SELECT COLUMN\_JSON() has been used ([MDEV-36929](https://jira.mariadb.org/browse/MDEV-36929)) * PAGE\_COMPRESSED ALTER TABLE operations inconsistent with innodb\_file\_per\_table setting ([MDEV-37886](https://jira.mariadb.org/browse/MDEV-37886)) * CREATE TABLE ... SELECT on mysql.innodb\_table\_stats can hang ([MDEV-38822](https://jira.mariadb.org/browse/MDEV-38822)) * Fixed a server assertion that occurred when an InnoDB DDL operation (such as ALTER TABLE) encountered a lock wait timeout during internal statistics updates. ([MDEV-38882](https://jira.mariadb.org/browse/MDEV-38882)) * JSON search functions, JSON\_EXISTS, JSON\_EXTRACT, JSON\_VALUE, JSON\_QUERY, JSON\_CONTAINS, JSON\_CONTAINS\_PATH, JSON\_ARRAY\_APPEND, JSON\_ARRAY\_INSERT, JSON\_LENGTH, JSON\_INSERT, JSON\_REMOVE, JSON\_KEYS, could result in a overwrite of memory resulting in a crash. ([MDEV-39213](https://jira.mariadb.org/browse/MDEV-39213)) * Fixed critical crashes in InnoDB purge threads when processing tables with indexed virtual columns. Resolved race conditions where purge workers incorrectly reused cached TABLE\* objects across different tables in the same batch, and added retry logic to handle concurrent DDL operations that could invalidate table handles during purge processing. ([MDEV-39261](https://jira.mariadb.org/browse/MDEV-39261)) * By inserting a crafted large JSON value into the mysql.global\_priv table and triggering FLUSH PRIVILEGES, the server can crash ([MDEV-39266](https://jira.mariadb.org/browse/MDEV-39266)) * Potential MariaDB Cluster hang when a DDL command or Sequence access is replicated to a cluster by async replication ([MENT-2671](https://jira.mariadb.org/browse/MENT-2671)) * Server can hang or crash after FLUSH QUERY CACHE is executed ([MDEV-25365](https://jira.mariadb.org/browse/MDEV-25365)) * If user has limited write set size using wsrep\_max\_ws\_rows or wsrep\_max\_ws\_size for Galera then multi-table update that updates transactional and non-transactional table is not allowed. Furthermore, limiting write set size is not allowed if there is active Galera transaction. ([MDEV-28750](https://jira.mariadb.org/browse/MDEV-28750)) * In SELECT statements where a HAVING claused used JSON\_KEYS the server could crash. ([MDEV-33984](https://jira.mariadb.org/browse/MDEV-33984)) * Extended the dependency tracking of DDL statements operating on a table which is referenced by foreign key constraints. This prevents potential replication time conflicts of such DDL statements with other transactions operation on the foreign key referencing tables. ([MDEV-34784](https://jira.mariadb.org/browse/MDEV-34784)) * MariaDB crashes when parsing fuzzer generated PARTITION ([MDEV-36362](https://jira.mariadb.org/browse/MDEV-36362)) * Fixed a critical assertion failure in InnoDB that occurred during consecutive ALTER IGNORE TABLE operations when using the COPY algorithm. The fix prevents a race condition where the background purge thread could "pin" a table object while it was being renamed or dropped, leading to a server crash. ([MDEV-36436](https://jira.mariadb.org/browse/MDEV-36436)) * Corrected a server crash that could occur when strings where appended in a JSON\_NORMALIZE SQL function. ([MDEV-37640](https://jira.mariadb.org/browse/MDEV-37640)) * Fixed an issue where a parallel replica configured to skip ER\_CONNECTION\_KILLED (i.e. --slave-skip-errors=1927) can hang or crash because it honored this configuration, but should not (this error code is internally repurposed for replication worker threads and cannot be ignored). ([MDEV-38624](https://jira.mariadb.org/browse/MDEV-38624)) * wsrep\_slave\_FK\_checks configuration option was deprecated and from no on has no effect. Slave foreign key checks are always on as otherwise leads to massive data inconsistency on all replicas which subsequently results in master node abort. ([MDEV-38787](https://jira.mariadb.org/browse/MDEV-38787)) * An update on a view which is using a table with a Sequence and NEXTVAL can crash the server ([MDEV-38815](https://jira.mariadb.org/browse/MDEV-38815)) * Regression on MDL conflict handling ([MDEV-38895](https://jira.mariadb.org/browse/MDEV-38895)) * Assertion on InnoDB temporary table, partition table and also during partial rollback when an ALTER IGNORE is executed. ([MDEV-38928](https://jira.mariadb.org/browse/MDEV-38928)) * If wsrep\_restart\_slave is used the MariaDB Enterprise Cluster replica node may hang during shutdown. ([MDEV-39011](https://jira.mariadb.org/browse/MDEV-39011)) * Fixed a server crash in the InnoDB purge thread caused by missing indexed virtual column data in the undo log during UPDATE operations. ([MDEV-39081](https://jira.mariadb.org/browse/MDEV-39081)) * In a multi-table UPDATE, the table list could incorrectly include tables that were not opened because they were not truly modified. This occurred when an UPDATE modified a table referenced by a foreign key constraint from a table that was not part of the multi-table update. ([MDEV-39685](https://jira.mariadb.org/browse/MDEV-39685)) ### Can result in unexpected behaviour * Empty string is erroneously allowed as a GEOMETRY column value ([MDEV-15479](https://jira.mariadb.org/browse/MDEV-15479)) * Fixes the issue occurred when ALTER TABLE contained duplicate DROP FOREIGN KEY operations (e.g., "DROP FOREIGN KEY f1, DROP FOREIGN KEY f1"). ([MDEV-19194](https://jira.mariadb.org/browse/MDEV-19194)) * The Debian helper script previous tried to CHECK TABLE on all Aria/MyiSAM tables. The discovery and execution though a combination of bash and SQL escaping that resulted in incorrect table names being checked in a variety of situtions. Because Aria has crash recovery the Debian's auto-check table on startup functionality was removed. ([MDEV-34902](https://jira.mariadb.org/browse/MDEV-34902)) * Fix InnoDB index corruption when renaming key names with case-only differences. ([MDEV-34951](https://jira.mariadb.org/browse/MDEV-34951)) * Parallel replication hang and stall due to incorrectly handled row lock conflict, missing deadlock kill ([MDEV-37133](https://jira.mariadb.org/browse/MDEV-37133)) * Fixed mariabackup to report my\_close() failures and prevent false success messages when disk space is exhausted. ([MDEV-38562](https://jira.mariadb.org/browse/MDEV-38562)) * An UPDATE could fail to return the error ER\_CHECKREAD when innodb\_snapshot\_isolation=ON and the transaction that had last modified the record was committed during the lock acquisition. ([MDEV-39263](https://jira.mariadb.org/browse/MDEV-39263)) * mbstream insufficient path validation ([MDEV-39408](https://jira.mariadb.org/browse/MDEV-39408)) * wsrep unsafe handling of parameters ([MDEV-39413](https://jira.mariadb.org/browse/MDEV-39413)) * FILE privilege isn't checked for derived table ([MDEV-39493](https://jira.mariadb.org/browse/MDEV-39493)) * A parameter-injection gap existed in wsrep\_sst\_rsync because it failed to validate the joiner-supplied WSREP\_SST\_OPT\_REMOTE\_USER and WSREP\_SST\_OPT\_REMOTE\_PSWD values before interpolating them into the donor-written stunnel.conf and the rsync magic file. ([MDEV-39648](https://jira.mariadb.org/browse/MDEV-39648)) * The wsrep\_notify\_cmd functionality was susceptible to a parameter-injection vulnerability, as it failed to validate the peer-supplied wsrep\_node\_name and wsrep\_node\_incoming\_address values before interpolating them into the notification command line. ([MDEV-39721](https://jira.mariadb.org/browse/MDEV-39721)) * An appropriately privileged user (with SUPER privileges) could execute shell commands as the uid of the mariadbd process because the values of the system variables wsrep\_sst\_donor and wsrep\_sst\_receive\_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command. ([MDEV-39676](https://jira.mariadb.org/browse/MDEV-39676)) * An appropriately privileged user (with SUPER or SYSTEM\_VARIABLES\_ADMIN privileges) could execute shell commands as the uid of the mariadbd process because the values of the system variable wsrep\_sst\_auth , which can be modified at runtime, were not properly sanitized when used to construct a shell command. ([MENT-2692](https://jira.mariadb.org/browse/MENT-2692)) * An appropriately privileged user (with SUPER or SYSTEM\_VARIABLES\_ADMIN privileges) could execute shell commands as the uid of the mariadbd process because the values of the system variable wsrep\_sst\_node\_address , which can be modified at runtime, were not properly sanitized when used to construct a shell command. ([MENT-2693](https://jira.mariadb.org/browse/MENT-2693)) * A MariaDB Enterprise Cluster SST is not possible with datadir locatated on NFS and log-bin enabled ([MENT-2435](https://jira.mariadb.org/browse/MENT-2435)) * When a mariadb server operates as a donor node in a galera cluster and uses mariabackup SST method, it will spawn mariabackup process to prepare the backup file and sending it to the joiner node. In earlier versions, this spawned mariabackup process inherited the max open file limits set for the parent mariadb server process. This has been changed so that the mariabackup process now honors the open\_files\_limit variable value configured in \[mariabackup] group in the mariadb configuration file and mariabackup process can have different open file limits than the mariadb server, ([MDEV-21935](https://jira.mariadb.org/browse/MDEV-21935)) * Queries with IN predicates operating on NULL values could sometimes return wrong results. ([MDEV-32868](https://jira.mariadb.org/browse/MDEV-32868)) * For INSERT.. ON DUPLICATE KEY UPDATE, AFTER UPDATE trigger is now always executed in case of duplicate key, even if update did not result in any data changes. This matches the existing behavior of UPDATE command. ([MDEV-33083](https://jira.mariadb.org/browse/MDEV-33083)) * mariabackup prepare fails with data-at-rest encryption and "-u root" option ([MDEV-34570](https://jira.mariadb.org/browse/MDEV-34570)) * Master & Relay Log info files read 2^31 and above incorrectly ([MDEV-38020](https://jira.mariadb.org/browse/MDEV-38020)) * Fixed an issue where the InnoDB system tablespace failed to shrink due to legacy internal tables. MariaDB now automatically detects and removes these orphaned entries during startup, allowing for successful defragmentation and reduction of the tablespace size. ([MDEV-38412](https://jira.mariadb.org/browse/MDEV-38412)) * mysql\_change\_user() with long passwords throws an error ([MDEV-38550](https://jira.mariadb.org/browse/MDEV-38550)) * On 64-bit systems other than IBM AIX, the minimum and default values of innodb\_buffer\_pool\_size\_max were changed to 8 MiB and 8 TiB, respectively. ([MDEV-38671](https://jira.mariadb.org/browse/MDEV-38671)) * An error during the execution of CREATE TEMPORARY TABLE…SELECT no longer results in a rollback of the entire transaction, but of the failing statement. ([MDEV-38769](https://jira.mariadb.org/browse/MDEV-38769)) * Fixed incorrectly formatted session tracking info in OK packet, after changing to database with UTF16/UTF32 default charset ([MDEV-38954](https://jira.mariadb.org/browse/MDEV-38954)) * After a successful execution of SET GLOBAL innodb\_buffer\_pool\_size, the buffer pool would be included in future core dumps, contrary to the expectation on Linux and FreeBSD. ([MDEV-38958](https://jira.mariadb.org/browse/MDEV-38958)) * ALTER TABLE ... IGNORE could trigger the assertion trx->undo\_no == 1 in InnoDB's undo log handling when a duplicate key error occurred during the copy phase. ([MDEV-38993](https://jira.mariadb.org/browse/MDEV-38993)) * The error message ER\_CHECKREAD (1020) was revised to suggest that InnoDB has rolled back the transaction: "try restarting transaction" ([MDEV-39264](https://jira.mariadb.org/browse/MDEV-39264)) * SHOW CREATE ROUTINE does not apply to roles ([MDEV-39288](https://jira.mariadb.org/browse/MDEV-39288)) * Write set buffers were released too early in the Galera library causing failure on IST with message "IST didn't contain all write sets, +expected last : last received: ". ([MDEV-39643](https://jira.mariadb.org/browse/MDEV-39643)) * The server failed to parse schema-qualified table names when the unquoted table name began with a digit. ([MDEV-39654](https://jira.mariadb.org/browse/MDEV-39654)) ### Related to install and upgrade * In case if the view mysql.user was created (e.g. in 10.6) with a server with an unexpected character\_set\_client or collation\_connection, e.g. utf8mb3 and utf8mb3\_general\_ci, mysql\_upgrade does not fix it to the expected latin1 and latin1\_swedish\_ci. ([MDEV-38698](https://jira.mariadb.org/browse/MDEV-38698)) * No longer necessary RPM conflict between between MariaDB-common and mysql-common removed. ([MDEV-38771](https://jira.mariadb.org/browse/MDEV-38771)) * Restored galera\_new\_cluster script functionality to take optional service name. ([MDEV-39262](https://jira.mariadb.org/browse/MDEV-39262)) * InnoDB would fail to start up on data files from MariaDB Server 10.x or earlier when innodb\_force\_recovery=6 is specified. ([MDEV-39303](https://jira.mariadb.org/browse/MDEV-39303)) ### Related to performance * The setting innodb\_log\_file\_mmap=ON did not enable memory-mapped log file parsing. ([MDEV-38730](https://jira.mariadb.org/browse/MDEV-38730)) * InnoDB will initiate page writes and checkpoints from a single thread also during startup and shutdown, which improves performance. ([MDEV-38968](https://jira.mariadb.org/browse/MDEV-38968)) * The PERFORMANCE\_SCHEMA instrument wait/synch/rwlock/innodb/log\_latch was removed in order to improve throughput by 0.5% or more. ([MDEV-39040](https://jira.mariadb.org/browse/MDEV-39040)) * Performance improvement in the oltp\_read\_write benchmark with transaction-isolation=READ-COMMITTED. ([MENT-2687](https://jira.mariadb.org/browse/MENT-2687)) ### Unexpected results * Change the "-0" results in many SELECT scenarios to just return "0". ([MDEV-38670](https://jira.mariadb.org/browse/MDEV-38670)) * wsrep\_slave\_FK\_checks configuration option was deprecated and from now on has no effect. Slave foreign key checks are always on as otherwise leads to massive data inconsistency on all replicas which subsequently results in master node abort. ([MDEV-39385](https://jira.mariadb.org/browse/MDEV-39385)) * Incorrect Calculation while using Avg Function ([MDEV-23278](https://jira.mariadb.org/browse/MDEV-23278)) * SHOW BINLOG EVENTS showed incorrect/inverted values for foreign\_key\_checks, check\_constraint\_checks, sql\_auto\_is\_null, and unique\_checks flags. ([MDEV-29804](https://jira.mariadb.org/browse/MDEV-29804)) * 0 changed to 0.0 caused by DISTINCT and UNION ALL ([MDEV-30255](https://jira.mariadb.org/browse/MDEV-30255)) * Optimizer trace does not escape double quotes, produces invalid JSON ([MDEV-30354](https://jira.mariadb.org/browse/MDEV-30354)) * CHANGE MASTER TO is implicitly changing the value of 'Using\_Gtid' from 'No' to 'No' ([MDEV-37842](https://jira.mariadb.org/browse/MDEV-37842)) * Master/Relay Log Info files ignore trailing garbage and overflows in numeric lines ([MDEV-38010](https://jira.mariadb.org/browse/MDEV-38010)) * Incorrect HAVING clause evaluation on grouped derived tables. ([MDEV-38070](https://jira.mariadb.org/browse/MDEV-38070)) * Correct JSON\_EXTRACT to return the correct results when its input is from a derived table. It previously incorrectly returned NULL. ([MDEV-38873](https://jira.mariadb.org/browse/MDEV-38873)) * Default expressions for table columns previously allowed an incompatible mix of collations with the functions IF, NVL2, IFNULL. Now ER\_CANT\_AGGREGATE\_2COLLATIONS is returned. ([MDEV-39002](https://jira.mariadb.org/browse/MDEV-39002)) * Is was previously possible to insert 0 or "0" into an ENUM where the ENUM defination didn't include these values. Now an Error WARN\_DATA\_TRUNCATED is returned in sql\_mode=STRICT\_ALL\_TABLES. ([MDEV-39043](https://jira.mariadb.org/browse/MDEV-39043)) * Wrong Results in Identical Queries Involving Grouping and Bitwise NOT (\~) ([MDEV-39131](https://jira.mariadb.org/browse/MDEV-39131)) * Incorrect result with LEFT JOIN and QUOTE ([MDEV-39235](https://jira.mariadb.org/browse/MDEV-39235)) * InnoDB system tablespace autoshrink fails with error "InnoDB: Cannot shrink the system tablespace; there is not much space to reclaim (last used extent=\