> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/enterprise-server/11.4/changelog-11.4.13-10.md).

# Changelog for MariaDB Enterprise Server 11.4.13-10

MariaDB Enterprise Server 11.4.13-10 is a Stable (GA) maintenance release of MariaDB Enterprise Server 11.4, released on 2026-09-07

<a href="https://mariadb.com/downloads/enterprise/enterprise-server/" class="button primary">Download</a> <a href="/docs/release-notes/enterprise-server/11.4/11.4.13-10.md" class="button secondary">Release Notes</a> <a class="button secondary">Changelog</a> <a href="/docs/release-notes/enterprise-server/11.4/whats-new.md" class="button secondary">Overview of Enterprise Server 11.4</a>

**Release date:** 7 Sep 2026

## Issues Fixed

* State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). ([MDEV-23744](https://jira.mariadb.org/browse/MDEV-23744))
  * Eight new options are added, read from the \[sst] (or \[mysqld]) option group. Each one overrides the corresponding generic ssl-\* option for its role when set; when it is not set, the generic ssl-\* option is used, so existing configurations behave exactly as before.
  * Joiner (TLS server) role:
    * ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * Donor (TLS client) role:
    * ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    * ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    * ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    * ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.
  * These are SST options read by the wsrep\_sst\_\* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
* When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. ([MDEV-28233](https://jira.mariadb.org/browse/MDEV-28233))
* Galera state transfers (SST) now interpret the `ssl-mode=VERIFY_CA` setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, `VERIFY_CA` was incorrectly treated as strictly as `VERIFY_IDENTITY`, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set `ssl-mode=VERIFY_IDENTITY` explicitly ([MDEV-28239](https://jira.mariadb.org/browse/MDEV-28239))
* JSON functions on large input; `JSON_CONTAIN`, `JSON_CONTAINS_PATH`, `JSON_EXISTS`, `JSON_EXTRACT`, and `JSON_KEYS`; were previously uninterruptible with KILL query, and could exceed their maximum query time ([MDEV-28404](https://jira.mariadb.org/browse/MDEV-28404))
* Server crash or assertion failure in `get_n_sincos` with nested `ST_BUFFER` ([MDEV-31267](https://jira.mariadb.org/browse/MDEV-31267))
* Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds ([MDEV-35812](https://jira.mariadb.org/browse/MDEV-35812))
* server crash hp\_rec\_key\_cmp ([MDEV-38722](https://jira.mariadb.org/browse/MDEV-38722))
* Fix memory disclosure (if not a crash) with v2 Rows Events with truncated extra data ([MDEV-39485](https://jira.mariadb.org/browse/MDEV-39485))
* Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated `Table_map_log_event` metadata, so a slave or mariadb-binlog --print-table-metadata now handle malformed table map events safely instead of crashing or leaking heap memory; thanks to Luke Lu of AWS for providing this fix ([MDEV-39689](https://jira.mariadb.org/browse/MDEV-39689))
* ExtractValue does not control recursion depth ([MDEV-39750](https://jira.mariadb.org/browse/MDEV-39750))
* A replica could crash when replicating compressed events (`log_bin_compress`) if an event's recorded uncompressed size was corrupted to a very large value; the replica sized its decompression workspace from that value without checking it, and the resulting mismatch corrupted the replica's memory or led it to request a 4GB allocation; the replica now rejects any uncompressed size larger than the largest packet a master can produce and stops its IO thread with a descriptive error ([MDEV-39762](https://jira.mariadb.org/browse/MDEV-39762))
* SHOW CREATE TABLE corrupts \`-quoted table options ([MDEV-39776](https://jira.mariadb.org/browse/MDEV-39776))
* `ST_GeomFromGeoJSON` in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. ([MDEV-39813](https://jira.mariadb.org/browse/MDEV-39813))
* backtick in FK names breaks SHOW CREATE TABLE ([MDEV-39818](https://jira.mariadb.org/browse/MDEV-39818))
* Server crashes in `sp_head::register_instr_mem_root_for_deallocation` upon shutdown ([MDEV-40004](https://jira.mariadb.org/browse/MDEV-40004))
* `cached_sha2_password` crashes on zero-length password ([MDEV-40058](https://jira.mariadb.org/browse/MDEV-40058))
* too long character\_set\_collations crash ([MDEV-40059](https://jira.mariadb.org/browse/MDEV-40059))
* bundled command-line clients don't always enforce length limits on server results ([MDEV-40065](https://jira.mariadb.org/browse/MDEV-40065))
* single quote in DATA DIRECTORY breaks SHOW CREATE TABLE ([MDEV-40159](https://jira.mariadb.org/browse/MDEV-40159))
* Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs ([MDEV-40298](https://jira.mariadb.org/browse/MDEV-40298))
* single quotes make SHOW CREATE USER invalid ([MDEV-40308](https://jira.mariadb.org/browse/MDEV-40308))
* mariadb-dump doesn't always quote identifiers ([MDEV-40311](https://jira.mariadb.org/browse/MDEV-40311))
* CONNECT file udfs ignore FILE and secure\_file\_priv ([MDEV-40323](https://jira.mariadb.org/browse/MDEV-40323))
* Binary\_string::qs\_append(char): Assertion \`str\_length + (uint32) (1) <= Alloced\_length' failed in AsText ([MDEV-40329](https://jira.mariadb.org/browse/MDEV-40329))
* \#mysql50# mixes up with table names in the table cache and on disk ([MDEV-40362](https://jira.mariadb.org/browse/MDEV-40362))
* Fix crash on Format Description event with incomplete contents ([MDEV-40365](https://jira.mariadb.org/browse/MDEV-40365))
* Fix crash on Format Description event with incomplete contents ([MDEV-40366](https://jira.mariadb.org/browse/MDEV-40366))
* `ALTER TABLE ... CONVERT ... PARTITION` doesn't encode partition names ([MDEV-40413](https://jira.mariadb.org/browse/MDEV-40413))
* Server crash in Charset::charset upon JSON operations ([MDEV-40414](https://jira.mariadb.org/browse/MDEV-40414))
* `GRANT PROXY` with empty password incorrectly checks grantor's privileges ([MDEV-40470](https://jira.mariadb.org/browse/MDEV-40470))
* A replica could crash on connecting to a master whose `binlog_checksum` setting differs from the setting in effect when the replica's relay log was written, if the master's binary log file name was longer than a file name may legally be; the replica did not check the length of the file name the master reported before storing it, so an overlong name corrupted the replica's memory; the replica now rejects the over-sized name and stops its IO thread with an error, instead of crashing ([MDEV-40492](https://jira.mariadb.org/browse/MDEV-40492))
* role vs user\@localhost acl\_cache key confusion ([MDEV-40541](https://jira.mariadb.org/browse/MDEV-40541))
* `mariadb-binlog --force-read` now consistently displays the checksum for Unknown events to match “known” events ([MDEV-40542](https://jira.mariadb.org/browse/MDEV-40542))
* `KILL` checks user (not `priv_user`) and doesn't verify hostname ([MDEV-40554](https://jira.mariadb.org/browse/MDEV-40554))
* insufficient validation of frm data when opening a table ([MDEV-40571](https://jira.mariadb.org/browse/MDEV-40571))
* `ST_CROSSES` always returns 0 for geometries of different dimensions ([MDEV-40584](https://jira.mariadb.org/browse/MDEV-40584))
* It was possible for a user with FILE privileges and a secure\_file\_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart. ([MDEV-40629](https://jira.mariadb.org/browse/MDEV-40629))
* The stunnel is a dependency of the Galera rsync sst mechanism. Its optional until a TLS configuration is applied for the SST mechanism. Added stunnel as a recommended package for RPMs and Debian packages for MariaDB-server and in 12.3, a required package of MariaDB-server-galera. ([MDEV-40630](https://jira.mariadb.org/browse/MDEV-40630))
* When running a DELETE on a table which is using the CSV storage engine, the server can crash ([MDEV-40636](https://jira.mariadb.org/browse/MDEV-40636))
* A replica could crash when a heartbeat or other event from its master arrived truncated, which can happen when the replication stream is corrupted in transit; the replica trusted the size the truncated event declared and tried to read and allocate far more data than the event held, in some builds nearly 4GB; such an event now stops the replica's IO thread with an error identifying the bad event length ([MDEV-40643](https://jira.mariadb.org/browse/MDEV-40643))
* A replica could crash when its master sent a row event carrying a database or table name longer than MariaDB allows an identifier to be, which indicates a corrupted or forged event; the replica copied the name into storage sized for a legal identifier without checking the length it was given; such an event now stops the replica's SQL thread with a replication error instead of crashing the replica ([MDEV-40644](https://jira.mariadb.org/browse/MDEV-40644))
* Slave Crash on Malformed `User_var_log_event` ([MDEV-40645](https://jira.mariadb.org/browse/MDEV-40645))
* A replica could crash, or copy unrelated memory into its own record of a replicated table's structure, when a row event described more columns than its accompanying column information covered; the replica accepted the event based on a size check too weak to catch the shortfall, then read column information the event did not contain; the replica now verifies that the event carries column information for every column it declares, and stops the SQL thread with a replication error when it does not ([MDEV-40646](https://jira.mariadb.org/browse/MDEV-40646))
* Fix crash in Rotate event when followed by a Format Description event describing no Rotate event support ([MDEV-40647](https://jira.mariadb.org/browse/MDEV-40647))
* A master could cause a replica to apply the same statement twice and end up with data the master's binary log never contained, by sending an event whose declared size disagrees with the amount of data actually sent; the replica stored such an event in its relay log as received, and a hidden second event in the surplus bytes was later applied as though the master had sent it; the replica now compares the two sizes on arrival, so a mismatched event stops the IO thread with an error and never reaches the relay log; this closes a gap that made a replica's data unverifiable against its master's binary log ([MDEV-40648](https://jira.mariadb.org/browse/MDEV-40648))
* `mysql_json` plugin OOB reads ([MDEV-40678](https://jira.mariadb.org/browse/MDEV-40678))
* DROP PACKAGE leaves PACKAGE BODY grant in `mysql.procs_priv` ([MDEV-40722](https://jira.mariadb.org/browse/MDEV-40722))
* MariaDB 11.4 Audit Plugin Changes server\_audit\_syslog\_ident from Hyphen (-) to Underscore (\_) ([MENT-2862](https://jira.mariadb.org/browse/MENT-2862))
* Name Resolution: Wrong result with grouping select from merged derived table ([MDEV-17846](https://jira.mariadb.org/browse/MDEV-17846))
* NATURAL JOIN operates on a derived table (or view with `derived_merge=off`) having more than 64 columns would crash the server with an assertion, bug fixed by Abdelrahman Hedia ([MDEV-24931](https://jira.mariadb.org/browse/MDEV-24931))
* Unexpected ERROR: Found out of order GTID after replaying binlog read from remote ([MDEV-29803](https://jira.mariadb.org/browse/MDEV-29803))
* Some queries combining recursive CTEs and subqueries might cause a server crash during execution ([MDEV-32326](https://jira.mariadb.org/browse/MDEV-32326))
* A range of JSON functions taking a path argument, when passed SQL expressions that don't have a character set, would crash the server ([MDEV-32331](https://jira.mariadb.org/browse/MDEV-32331))
* `ALTER TABLE ... AUTO_INCREMENT = NN`; should return a Warning if it can not use the provided value ([MDEV-33660](https://jira.mariadb.org/browse/MDEV-33660))
* InnoDB Encryption threads no longer busy-wait and now respond quickly for `innodb_encrypt_tables` and `innodb_encryption_rotate_key_age` ([MDEV-34358](https://jira.mariadb.org/browse/MDEV-34358))
* Server crashes simplifying group by ([MDEV-35565](https://jira.mariadb.org/browse/MDEV-35565))
* Cannot modify a column if there is a generated column before it and a foreign key ([MDEV-35630](https://jira.mariadb.org/browse/MDEV-35630))
* Invalid access, use-after-free, on `rli->description_event_for_exec` ([MDEV-35691](https://jira.mariadb.org/browse/MDEV-35691))
* Abnormal server termination on second execution of stored routine that runs a cursor after table metadata in the query was changed ([MDEV-36481](https://jira.mariadb.org/browse/MDEV-36481))
* The rsync SST method of Galera worked incorrectly if `innodb_log_group_home_dir` or `aria_log_dir_path` were not the same as datadir at the SST donor node; this release has a fix for the rsync SST script to support varying data directory locations ([MDEV-36677](https://jira.mariadb.org/browse/MDEV-36677))
* Unexpected collation when using `json_table` ([MDEV-36764](https://jira.mariadb.org/browse/MDEV-36764))
* Deleting from Aria table could result in a corrupt index on Windows ([MDEV-37000](https://jira.mariadb.org/browse/MDEV-37000))
* Service crashed on procedure call ([MDEV-37086](https://jira.mariadb.org/browse/MDEV-37086))
* The test case main.lotofstack failed under ASAN and UBSAN conditions; fix thanks to Mohd Jarir Khan ([MDEV-37664](https://jira.mariadb.org/browse/MDEV-37664))
* Partitioned tables now are named correctly on case insensitive filesystems have have predictable results when renaming and altering them ([MDEV-37739](https://jira.mariadb.org/browse/MDEV-37739))
* Incorrect query result ([MDEV-38158](https://jira.mariadb.org/browse/MDEV-38158))
* Unary negation of `LONGTEXT`, wrong result under GROUP BY ([MDEV-38210](https://jira.mariadb.org/browse/MDEV-38210))
* Fix incomplete cleanup in Galera MTR tests failing under --repeat ([MDEV-38386](https://jira.mariadb.org/browse/MDEV-38386))
* ASAN heap-use-after-free in `Query_arena::free_items/sp_lex_cursor::~sp_lex_cursor` ([MDEV-38561](https://jira.mariadb.org/browse/MDEV-38561))
* A potential deadlock happening when MariaDB sequence operation is replicated as part of Galera streaming replication has been fixed ([MDEV-38869](https://jira.mariadb.org/browse/MDEV-38869))
* Server crashes at `Item_func_lastval::val_int` and `Item_func_setval::val_int` with CTE alias ([MDEV-39063](https://jira.mariadb.org/browse/MDEV-39063))
* `JSON_EXISTS` was permitted to exceeded the depth for JSON functions ([MDEV-39276](https://jira.mariadb.org/browse/MDEV-39276))
* A 0xHHHH / b'..' literal kept its `hex_hybrid` type through COALESCE/IF/CASE/..., but was evaluated, sized and stored as a string, so it behaved differently from a bare literal (10+COALESCE(0x31) gave 11, not 59); `type_handler_hex_hybrid` now implements the numeric side to match the bare literal: `val_int`/`val_real`/`val_decimal` read bytes as a hybrid, `Item_decimal_precision` returns the integer precision, `Item_save_in_field stores` like the bare literal; the traditional type merge keeps the hybrid through a typeless NULL (as for BIT), and `Item_hybrid_func_fix_attributes` attributes it binary/unsigned ([MDEV-39380](https://jira.mariadb.org/browse/MDEV-39380))
* Fixed memory corruption that could occur when updating a COMPRESSED column to a substring of its own value (e.g. `UPDATE t SET c = RIGHT(c, n)` or `SUBSTRING(c, n)`), when the column's current value is short enough to be stored uncompressed (below `column_compression_threshold`, default 100 bytes). ([MDEV-39450](https://jira.mariadb.org/browse/MDEV-39450))
* In Oracle mode all set operators share one priority and bind left-to-right, so wrapping the accumulated prefix on each operator change enforces it ([MDEV-39522](https://jira.mariadb.org/browse/MDEV-39522))
* In --bootstrap mode, it was possible for a partially initialized InnoDB to be shutdown, and it was possible that this could crash the server ([MDEV-39541](https://jira.mariadb.org/browse/MDEV-39541))
* Under --bootstrap mode, used in mariadb-install-db, an unwanted delay was removed and it now calls the plugin clean up functions ([MDEV-39585](https://jira.mariadb.org/browse/MDEV-39585))
* Remove deprecated `wsrep_causal_reads` as a configuration option from provided wsrep.cnf ([MDEV-39691](https://jira.mariadb.org/browse/MDEV-39691))
* When selecting the result of `JSON_ARRAY_INTERSECT` from a cursor, result fields were blank due to incorrect setting of the length ([MDEV-39716](https://jira.mariadb.org/browse/MDEV-39716))
* Fix division function to produce correct decimal zero without sign ([MDEV-39744](https://jira.mariadb.org/browse/MDEV-39744))
* Flaky binlog.binlog\_gtid\_index test ([MDEV-39779](https://jira.mariadb.org/browse/MDEV-39779))
* handlersocket plugin default secret is empty ([MDEV-39841](https://jira.mariadb.org/browse/MDEV-39841))
* The error log associated when libaio failed to setup an asynchronous kernel interface was incorrect; it now reports the error code, a text version, and a reference to the manual page that shows a correction; fix thanks to Andreas Schwab ([MDEV-39925](https://jira.mariadb.org/browse/MDEV-39925))
* A Gitlab CI testing configuration in the codebase was failing on Centos Stream 9; fix thanks to Fariha Shaikh of AWS ([MDEV-39928](https://jira.mariadb.org/browse/MDEV-39928))
* The test case main.socket\_conflict was producing an incorrect result when run as the root user; bug report and fix thanks to Fariha Shaikh of AWS ([MDEV-39931](https://jira.mariadb.org/browse/MDEV-39931))
* Truncate of temporary table with `ENCRYPTED=NO` crashes under `innodb_encrypt_tables=FORCE` ([MDEV-40085](https://jira.mariadb.org/browse/MDEV-40085))
* MEMORY tables incorrectly restart index scan on DELETE ([MDEV-40186](https://jira.mariadb.org/browse/MDEV-40186))
* ASAN error on malformed WKB multipolygon ([MDEV-40328](https://jira.mariadb.org/browse/MDEV-40328))
* MyISAM/Aria silently truncate extensions from filenames, if too long ([MDEV-40395](https://jira.mariadb.org/browse/MDEV-40395))
* `ST_GeomFromText` stack overrun on deeply nested GeometryCollection ([MDEV-40409](https://jira.mariadb.org/browse/MDEV-40409))
* Galera metadata conflict locking might not look correct if `wsrep_debug=1` ([MDEV-40538](https://jira.mariadb.org/browse/MDEV-40538))
* `ST_GeomFromWKB` stack overrun on deeply nested GeometryCollection ([MDEV-40540](https://jira.mariadb.org/browse/MDEV-40540))
* InnoDB could fail to recover after being killed in a DDL operation. ([MDEV-40728](https://jira.mariadb.org/browse/MDEV-40728))
* When executing crash recovery in multiple batches, InnoDB may fail to extend a file and crash on a subsequent write to it ([MDEV-40756](https://jira.mariadb.org/browse/MDEV-40756))
* SIGABRT in TDBTBL::TestFil when reading a CONNECT table with TABLE\_TYPE=TBL ([MDEV-40867](https://jira.mariadb.org/browse/MDEV-40867))
* CREATE TABLE AS SELECT did not replicate correctly in Galera. ([MDEV-40929](https://jira.mariadb.org/browse/MDEV-40929))
* An ALTER TABLE on a system-versioned table that contains virtual columns and a fulltext index could crash. ([MDEV-40985](https://jira.mariadb.org/browse/MDEV-40985))
* perfschema.dml\_threads failed in buildbot with wrong errno ([MDEV-17746](https://jira.mariadb.org/browse/MDEV-17746))
* Assertion \`0' failed in ha\_partition::handle\_unordered\_next upon HANDLER READ from partitioned table ([MDEV-20195](https://jira.mariadb.org/browse/MDEV-20195))
* Assertion \`trx\_is\_registered\_for\_2pc(trx)' failed in innobase\_xa\_prepare on DROP and in innobase\_savepoint on SAVEPOINT ([MDEV-22848](https://jira.mariadb.org/browse/MDEV-22848))
* Assertion \`marked\_for\_read()' failed in Field\_varstring::val\_str on CHECKSUM TABLE ([MDEV-22943](https://jira.mariadb.org/browse/MDEV-22943))
* Error codes/messages reveal information about table structure ([MDEV-23086](https://jira.mariadb.org/browse/MDEV-23086))
* REPAIR command on ARCHIVE table destroys TEXT Data ([MDEV-24245](https://jira.mariadb.org/browse/MDEV-24245))
* duplicate CHECK constraint name ([MDEV-24598](https://jira.mariadb.org/browse/MDEV-24598))
* ASAN errors in `err_conv` / `field_unpack` upon multi-UPDATE causing `ER_DUP_ENTRY` ([MDEV-25813](https://jira.mariadb.org/browse/MDEV-25813))
* Success logon with proxy protocol did not reset connect error count ([MDEV-25817](https://jira.mariadb.org/browse/MDEV-25817))
* Unexpected bypass of lock, Assertion \`(have\_max && !have\_min) || (have\_max && have\_min && (max\_res == 0))' failed in QUICK\_GROUP\_MIN\_MAX\_SELECT::get\_next ([MDEV-25964](https://jira.mariadb.org/browse/MDEV-25964))
* A WKB multi-line with an invalid byte order field when passed to in `ST_GeomFromWKB` has been corrected to return a NULL result where it previously had a valid value ([MDEV-26813](https://jira.mariadb.org/browse/MDEV-26813))
* Assertion \`marked\_for\_read()' failed upon SELECT with VALUE(virtual column) ([MDEV-26820](https://jira.mariadb.org/browse/MDEV-26820))
* `mysqld_multi` starts same instance multiple times with the risk to crash database ([MDEV-26910](https://jira.mariadb.org/browse/MDEV-26910))
* Valgrind/MSAN errors in `Item_func_des_encrypt::val_str` ([MDEV-27561](https://jira.mariadb.org/browse/MDEV-27561))
* Valgrind/MSAN errors in ha\_partition::swap\_blobs() for BLOB not in secondary index ([MDEV-27569](https://jira.mariadb.org/browse/MDEV-27569))
* Standard Deviation Calculations for `PROCEDURE_ANALYSE()` on will no longer overflow on large BIGINT columns until their calculation exceeds the maximum DOUBLE value ([MDEV-28374](https://jira.mariadb.org/browse/MDEV-28374))
* Assertion \`marked\_for\_read()' failed upon range select with virtual column in index ([MDEV-28610](https://jira.mariadb.org/browse/MDEV-28610))
* Roles without grants are handled wrong ([MDEV-28743](https://jira.mariadb.org/browse/MDEV-28743))
* The comparison of two JSON objects with `JSON_EQUALS`, `JSON_NORMALIZE`, or ordering, could result in unpredictable results where there was an object with the same object key listed more than once; the normalization has been made consistent ([MDEV-28922](https://jira.mariadb.org/browse/MDEV-28922))
* Server crash / assertion failure in Compare\_identifiers::operator upon dropping period with empty name ([MDEV-30297](https://jira.mariadb.org/browse/MDEV-30297))
* On big-endian platforms, the interruption of the execution of JSON functions was previously not possible and this is now corrected; on all platforms the interruption of JSON\_OVERLAPS now returns the correct error code ([MDEV-30518](https://jira.mariadb.org/browse/MDEV-30518))
* The server does not detect changes in NULL-ability of system table columns ([MDEV-30555](https://jira.mariadb.org/browse/MDEV-30555))
* Server crash / ASAN use-after-poison in `Binary_string::free_buffer` / `Item_func_sformat::~Item_func_sformat` ([MDEV-31024](https://jira.mariadb.org/browse/MDEV-31024))
* Queries with window functions previously could not be killed during the processing of the window function; also the `max_statement_time` statement time for the execution of window functions was ignored; both of these behaviors are corrected ([MDEV-31209](https://jira.mariadb.org/browse/MDEV-31209))
* When fetching a false value from a JSON function using an SQL cursor, the "false" was truncated to "fals" due to an incorrect width in the protocol ([MDEV-31554](https://jira.mariadb.org/browse/MDEV-31554))
* Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition ([MDEV-31808](https://jira.mariadb.org/browse/MDEV-31808))
* Using Query Cache (not default) with a "`ALTER TABLE tbl CONVERT TABLE normal_table TO partition_definition`" query, there was query cache invalidation of "`normal_table`" that accessed freed memory, potentially resulting undefined behaviour ([MDEV-33170](https://jira.mariadb.org/browse/MDEV-33170))
* Assertion \`marked\_for\_read()' failure in Item\_func\_conv\_charset::Item\_func\_conv\_charset ([MDEV-33524](https://jira.mariadb.org/browse/MDEV-33524))
* Server could crash if `server_audit` plugin is uninstalled and reinstalled again ([MDEV-34074](https://jira.mariadb.org/browse/MDEV-34074))
* Replication slave is stuck without any error ([MDEV-34135](https://jira.mariadb.org/browse/MDEV-34135))
* Assertion \`marked\_for\_read()' failed in virtual my\_time\_t Field\_timestamp0::get\_timestamp(const uchar\*, ulong\*) const ([MDEV-34992](https://jira.mariadb.org/browse/MDEV-34992))
* A WKB geometry, multi-polygon or geometry collection, with an invalid byte order field when passed to in `ST_GeomFromWKB` has been corrected to return a NULL result where it previously had a valid value ([MDEV-35595](https://jira.mariadb.org/browse/MDEV-35595))
* Assertion \`decimals == 0' failed Item\_func\_mod::fix\_length\_and\_dec\_int ([MDEV-35920](https://jira.mariadb.org/browse/MDEV-35920))
* 2nd PS exec crash w/nested VIEWs ([MDEV-36059](https://jira.mariadb.org/browse/MDEV-36059))
* MariaDB cannot open page-compressed InnoDB tables at startup if `innodb_compression_algorithm` other than zlib is specified ([MDEV-36147](https://jira.mariadb.org/browse/MDEV-36147))
* Debug build assertion on incorrectly eliminated subqueries ([MDEV-36610](https://jira.mariadb.org/browse/MDEV-36610))
* Hashicorp Key Management plugin improved performance by avoiding calling expensive time retrieval functions ([MDEV-37187](https://jira.mariadb.org/browse/MDEV-37187))
* Server crashes when executing the FLUSH PRIVILEGES statement after starting the server with skip-grant-tables and creating the mysql.host table ([MDEV-37840](https://jira.mariadb.org/browse/MDEV-37840))
* SHOW TABLES allows users with only GRANT OPTION privilege to read all table names in the database "mysql" ([MDEV-37951](https://jira.mariadb.org/browse/MDEV-37951))
* `JSON_SCHEMA_VALID()` was returning incorrect result with JSON having array of objects. ([MDEV-38033](https://jira.mariadb.org/browse/MDEV-38033))
* `Item_name_const` forwarded `type_handler()` to the wrapped value but not `decimal_precision()`, so a hex literal wrapped in `NAME_CONST` reported the generic precision instead of its own, forward `decimal_precision()` too ([MDEV-38061](https://jira.mariadb.org/browse/MDEV-38061))
* Provide fallback message logging function when they are not present ([MDEV-38075](https://jira.mariadb.org/browse/MDEV-38075))
* Mariadb error 1950 after SST ([MDEV-38147](https://jira.mariadb.org/browse/MDEV-38147))
* Assertion failure in Diagnostics\_area::set\_error\_status / Reprepare\_observer::report\_error ([MDEV-38472](https://jira.mariadb.org/browse/MDEV-38472))
* Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer ([MDEV-38843](https://jira.mariadb.org/browse/MDEV-38843))
* Assertion \`table->vers\_write' fails upon ODKU into table with versioned column ([MDEV-38854](https://jira.mariadb.org/browse/MDEV-38854))
* Fix crash and ASAN/UBSAN errors caused by temporal functions( `LAST_DAY` , `CAST`) passing incorrect interval flags when nested under `EXTRACT` with `ZERO_DATE_TIME_CAST` ([MDEV-38971](https://jira.mariadb.org/browse/MDEV-38971))
* Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) ([MDEV-39047](https://jira.mariadb.org/browse/MDEV-39047))
* Check that plugin name is pure ASCII ([MDEV-39245](https://jira.mariadb.org/browse/MDEV-39245))
* Source RPMs generated now correctly generate build dependencies for dependencies that are include headers without libraries only. An explicit check, and there build dependency addition of the dtrace headers is performed if ENABLE\_DTRACE is a build configuration option. ([MDEV-39285](https://jira.mariadb.org/browse/MDEV-39285))
* Some race conditions were fixed in the `INFORMATION_SCHEMA` views `innodb_trx`, `innodb_locks`, `innodb_lock_waits`. ([MDEV-39344](https://jira.mariadb.org/browse/MDEV-39344))
* Logical Bug in `NOT ( ... XOR ... )` Evaluation with Implicit Type Conversion ([MDEV-39363](https://jira.mariadb.org/browse/MDEV-39363))
* Assertion \`n\_fields > n\_cols || type & 32' failed in dict\_index\_t::init\_change\_cols on ALTER ([MDEV-39448](https://jira.mariadb.org/browse/MDEV-39448))
* Floating point exception: division by zero in `Item_sum_ntile::val_int` ([MDEV-39451](https://jira.mariadb.org/browse/MDEV-39451))
* mariadb-backup could abort with the misleading error `"Was only able to copy log from X to Y, not Z; try increasing innodb_log_file_size"` even when the redo log was intact and far from full. The log copier could read a partially written tail block that still parsed with a valid CRC, advancing its parse position into the middle of a mini-transaction, after which it never caught up to the target LSN. The copier now parses the redo log only up to the server's durably flushed LSN (`Innodb_lsn_flushed`), and re-reads those bytes on a later pass. ([MDEV-39468](https://jira.mariadb.org/browse/MDEV-39468))
* Inlined the fast path for the disabled optimizer trace case, trading a function call for a predicted-branch on a hot path ([MDEV-39490](https://jira.mariadb.org/browse/MDEV-39490))
* Changing a table to the storage engine Mroonga and then performing a CHECK TABLE previously resulted in a crash ([MDEV-39556](https://jira.mariadb.org/browse/MDEV-39556))
* One-byte OOB write in PROXY protocol v1 header parser ([MDEV-39564](https://jira.mariadb.org/browse/MDEV-39564))
* missing filename check in mariadb-backup --decompress ([MDEV-39565](https://jira.mariadb.org/browse/MDEV-39565))
* PROXY v2 protocol uninitialized memory reads ([MDEV-39576](https://jira.mariadb.org/browse/MDEV-39576))
* dynamic column header missing sanity checks ([MDEV-39581](https://jira.mariadb.org/browse/MDEV-39581))
* Updated HELP system documentation and urls to the MariaDB Documentation ([MDEV-39584](https://jira.mariadb.org/browse/MDEV-39584))
* ASAN error on malformed WKB point ([MDEV-39657](https://jira.mariadb.org/browse/MDEV-39657))
* ASAN crash on invalid `proxy_protocol_networks` value ([MDEV-39658](https://jira.mariadb.org/browse/MDEV-39658))
* `group_concat` ignores `max_allowed_packet` ([MDEV-39673](https://jira.mariadb.org/browse/MDEV-39673))
* A high priority abort, by the Galera replication applier may have left the aborted victim's transaction's Innodb lock orphaned in the lock wait queue, which in some scenarios can cause temporary node hanging or a crash; this version has a fix for handling the lock wait state of high priority aborted transactions ([MDEV-39681](https://jira.mariadb.org/browse/MDEV-39681))
* Fix signed-integer-overflow in BLOB-to-integer conversion ([MDEV-39690](https://jira.mariadb.org/browse/MDEV-39690))
* Assertion \`!thd || !coordinator\_thd' failed ([MDEV-39706](https://jira.mariadb.org/browse/MDEV-39706))
* Assertion \`lsn != 0' failed ([MDEV-39707](https://jira.mariadb.org/browse/MDEV-39707))
* JSON functions added in 11.4 are now interruptible with a KILL QUERY, or exceeding the `max_statement_time`, including `JSON_ARRAY_INTERSECT`, `JSON_OBJECT_TO_ARRAY`, `JSON_SCHEMA_VALID`; the `JSON_KEY_VALUE` function as a quick function added isn't applicable; all the functions now produce warnings on invalid JSON passed to them ([MDEV-39742](https://jira.mariadb.org/browse/MDEV-39742))
* Fixed stale encryption metadata on compressed-only pages by clearing it, and fixed an assertion failure during extent reservation ([MDEV-39795](https://jira.mariadb.org/browse/MDEV-39795))
* Fixed an assertion failure with spatial index predicate locks ([MDEV-39800](https://jira.mariadb.org/browse/MDEV-39800))
* 32-bit size truncation in RocksDB ([MDEV-39812](https://jira.mariadb.org/browse/MDEV-39812))
* MyISAM crash on corrupted MYI with invalid keyseg length ([MDEV-39816](https://jira.mariadb.org/browse/MDEV-39816))
* `JSON_ARRAYAGG()` returns garbage because of off-by-one error ([MDEV-39817](https://jira.mariadb.org/browse/MDEV-39817))
* heap-use-after-free in heap\_rnext with tree indexes ([MDEV-39821](https://jira.mariadb.org/browse/MDEV-39821))
* Crash when pushing "NOT a" condition from HAVING into WHERE ([MDEV-39916](https://jira.mariadb.org/browse/MDEV-39916))
* Under `sql_mode=ONLY_FULL_GROUP_BY` when a correlated subquery aggregates a column of an outer query, the server previously incorrectly raised a `ER_WRONG_FIELD_WITH_GROUP` error rather than a correct result, bug report and fix thanks to Jaeheon Shim ([MDEV-39932](https://jira.mariadb.org/browse/MDEV-39932))
* `ST_GEOMFROMGEOJSON` when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object, thanks to Akshat Nehra of AWS for providing a solution to this ([MDEV-39981](https://jira.mariadb.org/browse/MDEV-39981))
* my\_sync() fails to use NtFlushBuffersFileEx() ([MDEV-40001](https://jira.mariadb.org/browse/MDEV-40001))
* Prepared Statement Crash in `varchar_upper_cmp_transformer()` for '?' ([MDEV-40006](https://jira.mariadb.org/browse/MDEV-40006))
* Assertion \`marked\_for\_read()' fails on slave upon RBR with unique blobs and binlog\_row\_image=MINIMAL #3 ([MDEV-40057](https://jira.mariadb.org/browse/MDEV-40057))
* Fix MSAN warnings in `REPLACE DELAYED` with system versioned tables ([MDEV-40099](https://jira.mariadb.org/browse/MDEV-40099))
* use-of-uninitialized-value in `THD::print_aborted_warning(unsigned int, char const*)` ([MDEV-40103](https://jira.mariadb.org/browse/MDEV-40103))
* A use of uninitialised memory may have resulted in a range query on a system versioned table based on its versioning rows having an unpredictable query plan ([MDEV-40147](https://jira.mariadb.org/browse/MDEV-40147))
* `JSON_OVERLAPS`, `JSON_LENGTH`, `JSON_DEPTH`, `JSON_EQUALS`, `JSON_NORMALIZE` didn't response to `KILL` query or respect the `max_statement` time system variable; `JSON_EQUALS` and `JSON_NORMALIZE` now return warnings on incorrect syntax ([MDEV-40165](https://jira.mariadb.org/browse/MDEV-40165))
* duckdb.db keeps growing on frequent load of tpchsf1000 ([MDEV-40166](https://jira.mariadb.org/browse/MDEV-40166))
* Validation during json normalization has bee made inline for increased performance. ([MDEV-40174](https://jira.mariadb.org/browse/MDEV-40174))
* `JSON_VALID` wasn't able to be stopped if a large document was passed to it; it also failed to respect the `max_statement_time`; in correcting the error handling of this function there is also an SQL note if the JSON is invalid indicating at what position it is invalid and why ([MDEV-40175](https://jira.mariadb.org/browse/MDEV-40175))
* Found N prepared transactions after mariabackup SST ([MDEV-40179](https://jira.mariadb.org/browse/MDEV-40179))
* Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter; fix thanks to Syed Mohammed Nayyar ([MDEV-40200](https://jira.mariadb.org/browse/MDEV-40200))
* Fix out of bound read in `my_mb_wc_filename`; fixed by Syed Mohammed Nayyar ([MDEV-40201](https://jira.mariadb.org/browse/MDEV-40201))
* InnoDB partitioned system version tables could crash during an InnoDB purge if the table wasn't already open attempting to resolve the ROW\_START/ROW\_END columns ([MDEV-40237](https://jira.mariadb.org/browse/MDEV-40237))
* UUID columns contains all zeros in DuckDB table. ([MDEV-40265](https://jira.mariadb.org/browse/MDEV-40265))
* Fix Static Application Security Testing(SAST) warnings in Connect storage engine ([MDEV-40316](https://jira.mariadb.org/browse/MDEV-40316))
* symlinked table name is not encoded ([MDEV-40358](https://jira.mariadb.org/browse/MDEV-40358))
* CONNECT REST can pass arguments to curl via HTTP parameter ([MDEV-40360](https://jira.mariadb.org/browse/MDEV-40360))
* SFORMAT ignores `max_allowed_packet` ([MDEV-40411](https://jira.mariadb.org/browse/MDEV-40411))
* CONNECT writes unvalidated data from remote server into fixed-len buffer ([MDEV-40426](https://jira.mariadb.org/browse/MDEV-40426))
* On the successful {{LOAD DATA LOCAL INFILE}} path, a {{BEFORE INSERT}} trigger can change a base column while a {{STORED}} generated column retains the value computed before that trigger change. The persisted row therefore violates its own generated-column expression. ([MDEV-40480](https://jira.mariadb.org/browse/MDEV-40480))
* Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated ([MDEV-40484](https://jira.mariadb.org/browse/MDEV-40484))
* Fix memory leak for incorrect checksums in `mariadb-binlog --verify-binlog-checksum --force-read` ([MDEV-40544](https://jira.mariadb.org/browse/MDEV-40544))
* A WKB multi-point with an invalid byte order field when passed to the function `ST_GeomFromWKB` has been corrected to return a NULL result where it previously had a valid value ([MDEV-40552](https://jira.mariadb.org/browse/MDEV-40552))
* rpl.rpl\_gtid\_crash fails due to salve Failed to sync with master ([MDEV-40575](https://jira.mariadb.org/browse/MDEV-40575))
* CONNECT crashes on double(255,50) in DOS table ([MDEV-40637](https://jira.mariadb.org/browse/MDEV-40637))
* The `file_key_management` plugin can crash if the key file is empty ([MDEV-40658](https://jira.mariadb.org/browse/MDEV-40658))
* `qc_info` OOB read if query contains \0 ([MDEV-40670](https://jira.mariadb.org/browse/MDEV-40670))
* Fix `ROLLUP` query results with empty result set. ([MDEV-40698](https://jira.mariadb.org/browse/MDEV-40698))
* Redundant calls to convert implicit record locks to explicit ones when table S-lock is held ([MDEV-40805](https://jira.mariadb.org/browse/MDEV-40805))
* Large memory allocations use `MAP_NORESERVE` where available (Linux and Illumos) to ensure that large memory mappings (e.g. 8TiB on default `innodb_buffer_pool_size_max`) do not result in memory actually being reserved (which it is by default on Illumos). --large-page memory behaviour isn't changed. ([MDEV-40921](https://jira.mariadb.org/browse/MDEV-40921))
* Galera test failure on galera.galera\_sst\_mariabackup\_ssl\_role\_certs ([MDEV-40944](https://jira.mariadb.org/browse/MDEV-40944))
* Galera SST may fail if binlog directory is configured to different place than datadir. ([MENT-2867](https://jira.mariadb.org/browse/MENT-2867))
* Incorrect information in file: './test/t0.frm' on CREATE TABLE ([MDEV-28498](https://jira.mariadb.org/browse/MDEV-28498))
* The InnoDB deadlock detector could report incorrectly which transaction is being rolled back. ([MDEV-37977](https://jira.mariadb.org/browse/MDEV-37977))
* Correct a memory leak in the Connect engine INI type that occurred when a file failed to open ([MDEV-39513](https://jira.mariadb.org/browse/MDEV-39513))
* Assertion \`bitmap\_is\_set\_all(\&table->s->all\_set)' fails on slave with binlog\_row\_image=MINIMAL ([MDEV-39774](https://jira.mariadb.org/browse/MDEV-39774))
* The test case for plugins.feedback\_os\_release incorrectly failed based on /etc/os-release contents; fix thanks to Tomáš Mózes ([MDEV-39784](https://jira.mariadb.org/browse/MDEV-39784))
* Fixed a rare InnoDB race during XA PREPARE where a concurrent buffer-pool resize could cause the wrong lock latch to be released, risking a hang or crash ([MDEV-40218](https://jira.mariadb.org/browse/MDEV-40218))
* The mariadb client was using .mariadb\_histor (without the trailing 'y') as the storage name for command line history ([MDEV-40313](https://jira.mariadb.org/browse/MDEV-40313))
* InnoDB: Defragmentation of BASE\_IDX in SYS\_VIRTUAL failed: Data structure corruption ([MDEV-40332](https://jira.mariadb.org/browse/MDEV-40332))
* UDF: CWE-400 (Uncontrolled Resource Consumption) ([MDEV-40345](https://jira.mariadb.org/browse/MDEV-40345))
* handlersocket crashes on read with huge number of fields ([MDEV-40425](https://jira.mariadb.org/browse/MDEV-40425))
* a CMP0218 warning with cmake 4.4 ([MDEV-40391](https://jira.mariadb.org/browse/MDEV-40391))

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}