See what's new in MariaDB Enterprise Server 11.8
{% endhint %} ## Fixed Security Vulnerabilities Some of these issues do not yet have a CVE identifier. Those are listed by their GitHub Security Advisory (GHSA) ID instead. The advisories are published on the [MariaDB Server GitHub Security Advisories page](https://github.com/MariaDB/server/security/advisories), and a CVE identifier is added once assigned. | Advisory (CVE or GHSA) | CVSS base score (v3.1) | | ----------------------------------------------------------------- | ---------------------- | | [CVE-2026-47023](https://www.cve.org/CVERecord?id=CVE-2026-47023) | 4.9 | | [CVE-2026-60184](https://www.cve.org/CVERecord?id=CVE-2026-60184) | 4.4 | | [CVE-2026-60331](https://www.cve.org/CVERecord?id=CVE-2026-60331) | 6.4 | | [CVE-2026-60585](https://www.cve.org/CVERecord?id=CVE-2026-60585) | 6.6 | | [CVE-2026-60747](https://www.cve.org/CVERecord?id=CVE-2026-60747) | 6.2 | | [CVE-2026-61081](https://www.cve.org/CVERecord?id=CVE-2026-61081) | 2.7 | | [CVE-2026-85745](https://www.cve.org/CVERecord?id=CVE-2026-85745) | 4.3 | | [CVE-2026-85746](https://www.cve.org/CVERecord?id=CVE-2026-85746) | 9.9 | | [CVE-2026-85748](https://www.cve.org/CVERecord?id=CVE-2026-85748) | 9.9 | | [CVE-2026-85985](https://www.cve.org/CVERecord?id=CVE-2026-85985) | 5.4 | | [CVE-2026-86047](https://www.cve.org/CVERecord?id=CVE-2026-86047) | 7.7 | | GHSA-65jj-h265-3m7h | 9.9 | | GHSA-625w-4hgq-qwmr | 8.8 | | GHSA-h4vr-wpff-jfx4 | 8.0 | | GHSA-g2q2-3936-cp37 | 7.2 | | GHSA-2m85-2x26-36rf | 6.4 | | GHSA-c4gx-34mg-95q5 | 8.0 | | GHSA-fmq9-qjxj-qpf7 | 5.9 | | GHSA-mhvc-vqcq-7vq5 | 8.4 | | GHSA-4wgx-ffg9-jrwq | 8.5 | | GHSA-wfqg-88r5-55f6 | 6.4 | | GHSA-89ph-64cf-gqcc | 4.4 | [Full list of Fixed Security Vulnerabilities in MariaDB Enterprise Server](/docs/server/security/cve/enterprise-server.md) ## Changes in Storage Engines * This release incorporates MariaDB ColumnStore engine version 25.10.6 ## Notable Changes * State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). ([MDEV-23744](https://jira.mariadb.org/browse/MDEV-23744)) * Eight new options are added, read from the \[sst] (or \[mysqld]) option group. Each one overrides the corresponding generic ssl-\* option for its role when set; when it is not set, the generic ssl-\* option is used, so existing configurations behave exactly as before. * Joiner (TLS server) role: * ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used. * ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used. * ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used. * ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used. * Donor (TLS client) role: * ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used. * ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used. * ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used. * ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used. * These are SST options read by the `wsrep_sst_*` scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible. * When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer. ([MDEV-28233](https://jira.mariadb.org/browse/MDEV-28233)) * Galera state transfers (SST) now interpret the `ssl-mode=VERIFY_CA` setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address; previously, `VERIFY_CA` was incorrectly treated as strictly as `VERIFY_IDENTITY`, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set `ssl-mode=VERIFY_IDENTITY` explicitly ([MDEV-28239](https://jira.mariadb.org/browse/MDEV-28239)) * Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (`skip_name_resolve` is not set) ([MDEV-37556](https://jira.mariadb.org/browse/MDEV-37556)) * Updated HELP system documentation and urls to the MariaDB Documentation ([MDEV-39584](https://jira.mariadb.org/browse/MDEV-39584)) * The error log associated when libaio failed to setup an asynchronous kernel interface was incorrect; it now reports the error code, a text version, and a reference to the manual page that shows a correction ([MDEV-39925](https://jira.mariadb.org/browse/MDEV-39925)) ## Issues Fixed ### Can result in data loss * REPAIR command on ARCHIVE table destroys TEXT Data ([MDEV-24245](https://jira.mariadb.org/browse/MDEV-24245)) * Fixed memory corruption that could occur when updating a COMPRESSED column to a substring of its own value (e.g. `UPDATE t SET c = RIGHT(c, n)` or `SUBSTRING(c, n)`), when the column's current value is short enough to be stored uncompressed (below `column_compression_threshold`, default 100 bytes). ([MDEV-39450](https://jira.mariadb.org/browse/MDEV-39450)) * mariadb-backup could abort with the misleading error `"Was only able to copy log from X to Y, not Z; try increasing innodb_log_file_size"` even when the redo log was intact and far from full. The log copier could read a partially written tail block that still parsed with a valid CRC, advancing its parse position into the middle of a mini-transaction, after which it never caught up to the target LSN. The copier now parses the redo log only up to the server's durably flushed LSN (`Innodb_lsn_flushed`), and re-reads those bytes on a later pass. ([MDEV-39468](https://jira.mariadb.org/browse/MDEV-39468)) * Fix signed-integer-overflow in BLOB-to-integer conversion ([MDEV-39690](https://jira.mariadb.org/browse/MDEV-39690)) * Single quote in `DATA DIRECTORY` breaks `SHOW CREATE TABLE` ([MDEV-40159](https://jira.mariadb.org/browse/MDEV-40159)) ### Can result in hang or crash * Assertion `trx_is_registered_for_2pc(trx)` failed in `innobase_xa_prepare` on DROP and in `innobase_savepoint` on SAVEPOINT ([MDEV-22848](https://jira.mariadb.org/browse/MDEV-22848)) * Assertion `marked_for_read()` failed in `Field_varstring::val_str` on CHECKSUM TABLE ([MDEV-22943](https://jira.mariadb.org/browse/MDEV-22943)) * NATURAL JOIN operates on a derived table (or view with `derived_merge=off`) having more than 64 columns would crash the server with an assertion, bug fixed by Abdelrahman Hedia ([MDEV-24931](https://jira.mariadb.org/browse/MDEV-24931)) * ASAN errors in `err_conv` / `field_unpack` upon multi-UPDATE causing `ER_DUP_ENTRY` ([MDEV-25813](https://jira.mariadb.org/browse/MDEV-25813)) * Unexpected bypass of lock, Assertion `(have_max && !have_min) || (have_max && have_min && (max_res == 0))` failed in `QUICK_GROUP_MIN_MAX_SELECT::get_next` ([MDEV-25964](https://jira.mariadb.org/browse/MDEV-25964)) * Assertion `marked_for_read()` failed upon SELECT with VALUE(virtual column) ([MDEV-26820](https://jira.mariadb.org/browse/MDEV-26820)) * Assertion `marked_for_read()` failed upon range select with virtual column in index ([MDEV-28610](https://jira.mariadb.org/browse/MDEV-28610)) * `ALTER TABLE ... DROP PERIOD IF EXISTS FOR` can trigger an assertion failure in debug builds and crash in non-debug builds ([MDEV-30297](https://jira.mariadb.org/browse/MDEV-30297)) * Server crash / ASAN use-after-poison in `Binary_string::free_buffer` / `Item_func_sformat::~Item_func_sformat` ([MDEV-31024](https://jira.mariadb.org/browse/MDEV-31024)) * Server crash or assertion failure in `get_n_sincos` with nested `ST_BUFFER` ([MDEV-31267](https://jira.mariadb.org/browse/MDEV-31267)) * Fixed a server crash during the ALTER TABLE under a LOCK=EXCLUSIVE where there was a NEXTVAL expression in the current table definition ([MDEV-31808](https://jira.mariadb.org/browse/MDEV-31808)) * Some queries combining recursive CTEs and subqueries might cause a server crash during execution ([MDEV-32326](https://jira.mariadb.org/browse/MDEV-32326)) * A range of JSON functions taking a path argument, when passed SQL expressions that don't have a character set, would crash the server ([MDEV-32331](https://jira.mariadb.org/browse/MDEV-32331)) * Server could crash if `server_audit` plugin is uninstalled and reinstalled again ([MDEV-34074](https://jira.mariadb.org/browse/MDEV-34074)) * Replication slave is stuck without any error ([MDEV-34135](https://jira.mariadb.org/browse/MDEV-34135)) * Assertion `marked_for_read()` failed in virtual `my_time_t Field_timestamp0::get_timestamp(const uchar*, ulong*)` const ([MDEV-34992](https://jira.mariadb.org/browse/MDEV-34992)) * Server crashes simplifying group by ([MDEV-35565](https://jira.mariadb.org/browse/MDEV-35565)) * Assertion `decimals == 0` failed `Item_func_mod::fix_length_and_dec_int` ([MDEV-35920](https://jira.mariadb.org/browse/MDEV-35920)) * 2nd PS exec crash w/nested VIEWs ([MDEV-36059](https://jira.mariadb.org/browse/MDEV-36059)) * Abnormal server termination on second execution of stored routine that runs a cursor after table metadata in the query was changed ([MDEV-36481](https://jira.mariadb.org/browse/MDEV-36481)) * Service crashed on procedure call ([MDEV-37086](https://jira.mariadb.org/browse/MDEV-37086)) * Server crashes when executing the FLUSH PRIVILEGES statement after starting the server with skip-grant-tables and creating the mysql.host table ([MDEV-37840](https://jira.mariadb.org/browse/MDEV-37840)) * `Item_name_const` forwarded `type_handler()` to the wrapped value but not `decimal_precision()`, so a hex literal wrapped in `NAME_CONST` reported the generic precision instead of its own, forward `decimal_precision()` too ([MDEV-38061](https://jira.mariadb.org/browse/MDEV-38061)) * Mariadb error 1950 after SST ([MDEV-38147](https://jira.mariadb.org/browse/MDEV-38147)) * Fix for regression coming from MDEV-34924 , which refactors `gtid_slave_pos` table handling in replication; the fix here is for potential cluster hanging when DDL or Sequence access is replicated to a cluster by async replication ([MDEV-38260](https://jira.mariadb.org/browse/MDEV-38260)) * ASAN heap-use-after-free in `Query_arena::free_items/sp_lex_cursor::~sp_lex_cursor` ([MDEV-38561](https://jira.mariadb.org/browse/MDEV-38561)) * Fixed a rare Galera cluster lockup where, after a write set could not be applied on one node, that node would silently stay in the cluster instead of stepping out; new write sets kept arriving but could not be processed, leaving the cluster unable to make progress until the node was killed and restarted; the node now reports the apply failure to the cluster, loses the consistency check, and is evicted automatically so it can rejoin via state transfer ([MDEV-38843](https://jira.mariadb.org/browse/MDEV-38843)) * Fix crash and ASAN/UBSAN errors caused by temporal functions( `LAST_DAY` , `CAST`) passing incorrect interval flags when nested under `EXTRACT` with `ZERO_DATE_TIME_CAST` ([MDEV-38971](https://jira.mariadb.org/browse/MDEV-38971)) * Server crashes at `Item_func_lastval::val_int` and `Item_func_setval::val_int` with CTE alias ([MDEV-39063](https://jira.mariadb.org/browse/MDEV-39063)) * Some race conditions were fixed in the `INFORMATION_SCHEMA` views `innodb_trx`, `innodb_locks`, `innodb_lock_waits` ([MDEV-39344](https://jira.mariadb.org/browse/MDEV-39344)) * A 0xHHHH / b'..' literal kept its `hex_hybrid` type through COALESCE/IF/CASE/..., but was evaluated, sized and stored as a string, so it behaved differently from a bare literal (10+COALESCE(0x31) gave 11, not 59); `type_handler_hex_hybrid` now implements the numeric side to match the bare literal: `val_int`/`val_real`/`val_decimal` read bytes as a hybrid, `Item_decimal_precision` returns the integer precision, `Item_save_in_field stores` like the bare literal; the traditional type merge keeps the hybrid through a typeless NULL (as for BIT), and `Item_hybrid_func_fix_attributes` attributes it binary/unsigned ([MDEV-39380](https://jira.mariadb.org/browse/MDEV-39380)) * Floating point exception: division by zero in `Item_sum_ntile::val_int` ([MDEV-39451](https://jira.mariadb.org/browse/MDEV-39451)) * Fix memory disclosure (if not a crash) with v2 Rows Events with truncated extra data ([MDEV-39485](https://jira.mariadb.org/browse/MDEV-39485)) * In --bootstrap mode, it was possible for a partially initialized InnoDB to be shutdown, and it was possible that this could crash the server ([MDEV-39541](https://jira.mariadb.org/browse/MDEV-39541)) * SIGSEGV in collect\_indexed\_vcols\_for\_table, memory corruption by my\_copy\_8bit from charset\_info\_st::copy\_fix ([MDEV-39558](https://jira.mariadb.org/browse/MDEV-39558)) * Fixed a server crash during UNIQUE constraint checks or prefix index scans on empty BLOB/TEXT columns ([MDEV-39559](https://jira.mariadb.org/browse/MDEV-39559)) * One-byte OOB write in PROXY protocol v1 header parser ([MDEV-39564](https://jira.mariadb.org/browse/MDEV-39564)) * ASAN crash on invalid `proxy_protocol_networks` value ([MDEV-39658](https://jira.mariadb.org/browse/MDEV-39658)) * `group_concat` ignores `max_allowed_packet` ([MDEV-39673](https://jira.mariadb.org/browse/MDEV-39673)) * A high priority abort, by the Galera replication applier may have left the aborted victim's transaction's Innodb lock orphaned in the lock wait queue, which in some scenarios can cause temporary node hanging or a crash; this version has a fix for handling the lock wait state of high priority aborted transactions ([MDEV-39681](https://jira.mariadb.org/browse/MDEV-39681)) * Fixed multiple out-of-bounds memory reads when parsing corrupted or truncated `Table_map_log_event` metadata, so a slave or `mariadb-binlog --print-table-metadata` now handle malformed table map events safely instead of crashing or leaking heap memory ([MDEV-39689](https://jira.mariadb.org/browse/MDEV-39689)) * Fix division function to produce correct decimal zero without sign ([MDEV-39744](https://jira.mariadb.org/browse/MDEV-39744)) * ExtractValue does not control recursion depth ([MDEV-39750](https://jira.mariadb.org/browse/MDEV-39750)) * A replica could crash when replicating compressed events (`log_bin_compress`) if an event's recorded uncompressed size was corrupted to a very large value; the replica sized its decompression workspace from that value without checking it, and the resulting mismatch corrupted the replica's memory or led it to request a 4GB allocation; the replica now rejects any uncompressed size larger than the largest packet a master can produce and stops its IO thread with a descriptive error ([MDEV-39762](https://jira.mariadb.org/browse/MDEV-39762)) * Fixed stale encryption metadata on compressed-only pages by clearing it, and fixed an assertion failure during extent reservation ([MDEV-39795](https://jira.mariadb.org/browse/MDEV-39795)) * Fixed an assertion failure with spatial index predicate locks ([MDEV-39800](https://jira.mariadb.org/browse/MDEV-39800)) * `ST_GeomFromGeoJSON` in processing its JSON object did not check the depth of processing and could potentially overrun memory. The depth of 32 is now enforced for MariaDB versions < 12.3, after which the depth is limited by the operating system stack size. ([MDEV-39813](https://jira.mariadb.org/browse/MDEV-39813)) * MyISAM crash on corrupted MYI with invalid keyseg length ([MDEV-39816](https://jira.mariadb.org/browse/MDEV-39816)) * Server crashes in `sp_head::register_instr_mem_root_for_deallocation` upon shutdown ([MDEV-40004](https://jira.mariadb.org/browse/MDEV-40004)) * Prepared Statement Crash in `varchar_upper_cmp_transformer()` for '?' ([MDEV-40006](https://jira.mariadb.org/browse/MDEV-40006)) * `cached_sha2_password` crashes on zero-length password ([MDEV-40058](https://jira.mariadb.org/browse/MDEV-40058)) * Too long `character_set_collations` crash ([MDEV-40059](https://jira.mariadb.org/browse/MDEV-40059)) * Bundled command-line clients don't always enforce length limits on server results ([MDEV-40065](https://jira.mariadb.org/browse/MDEV-40065)) * Truncate of temporary table with `ENCRYPTED=NO` crashes under `innodb_encrypt_tables=FORCE` ([MDEV-40085](https://jira.mariadb.org/browse/MDEV-40085)) * Fix MSAN warnings in `REPLACE DELAYED` with system versioned tables ([MDEV-40099](https://jira.mariadb.org/browse/MDEV-40099)) * Found N prepared transactions after mariabackup SST ([MDEV-40179](https://jira.mariadb.org/browse/MDEV-40179)) * Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs ([MDEV-40298](https://jira.mariadb.org/browse/MDEV-40298)) * ASAN error on malformed WKB multipolygon ([MDEV-40328](https://jira.mariadb.org/browse/MDEV-40328)) * mariadb-import --lock-tables crashes ([MDEV-40340](https://jira.mariadb.org/browse/MDEV-40340)) * \#mysql50# mixes up with table names in the table cache and on disk ([MDEV-40362](https://jira.mariadb.org/browse/MDEV-40362)) * Fix crash on Format Description event with incomplete contents ([MDEV-40365](https://jira.mariadb.org/browse/MDEV-40365)) * Fix crash on Format Description event with incomplete contents ([MDEV-40366](https://jira.mariadb.org/browse/MDEV-40366)) * `ST_GeomFromText` stack overrun on deeply nested GeometryCollection ([MDEV-40409](https://jira.mariadb.org/browse/MDEV-40409)) * A replica could crash on connecting to a master whose `binlog_checksum` setting differs from the setting in effect when the replica's relay log was written, if the master's binary log file name was longer than a file name may legally be; the replica did not check the length of the file name the master reported before storing it, so an overlong name corrupted the replica's memory; the replica now rejects the over-sized name and stops its IO thread with an error, instead of crashing ([MDEV-40492](https://jira.mariadb.org/browse/MDEV-40492)) * `ST_GeomFromWKB` stack overrun on deeply nested GeometryCollection ([MDEV-40540](https://jira.mariadb.org/browse/MDEV-40540)) * insufficient validation of frm data when opening a table ([MDEV-40571](https://jira.mariadb.org/browse/MDEV-40571)) * A replica could crash when a heartbeat or other event from its master arrived truncated, which can happen when the replication stream is corrupted in transit; the replica trusted the size the truncated event declared and tried to read and allocate far more data than the event held, in some builds nearly 4GB; such an event now stops the replica's IO thread with an error identifying the bad event length ([MDEV-40643](https://jira.mariadb.org/browse/MDEV-40643)) * A replica could crash when its master sent a row event carrying a database or table name longer than MariaDB allows an identifier to be, which indicates a corrupted or forged event; the replica copied the name into storage sized for a legal identifier without checking the length it was given; such an event now stops the replica's SQL thread with a replication error instead of crashing the replica ([MDEV-40644](https://jira.mariadb.org/browse/MDEV-40644)) * Slave Crash on Malformed `User_var_log_event` ([MDEV-40645](https://jira.mariadb.org/browse/MDEV-40645)) * A replica could crash, or copy unrelated memory into its own record of a replicated table's structure, when a row event described more columns than its accompanying column information covered; the replica accepted the event based on a size check too weak to catch the shortfall, then read column information the event did not contain; the replica now verifies that the event carries column information for every column it declares, and stops the SQL thread with a replication error when it does not ([MDEV-40646](https://jira.mariadb.org/browse/MDEV-40646)) * Fix crash in Rotate event when followed by a Format Description event describing no Rotate event support ([MDEV-40647](https://jira.mariadb.org/browse/MDEV-40647)) * The `file_key_management` plugin can crash if the key file is empty ([MDEV-40658](https://jira.mariadb.org/browse/MDEV-40658)) * When executing crash recovery in multiple batches, InnoDB may fail to extend a file and crash on a subsequent write to it ([MDEV-40756](https://jira.mariadb.org/browse/MDEV-40756)) * An ALTER TABLE on a system-versioned table that contains virtual columns and a fulltext index could crash. ([MDEV-40985](https://jira.mariadb.org/browse/MDEV-40985)) ### Can result in unexpected behaviour * Duplicate CHECK constraint name ([MDEV-24598](https://jira.mariadb.org/browse/MDEV-24598)) * Success logon with proxy protocol did not reset connect error count ([MDEV-25817](https://jira.mariadb.org/browse/MDEV-25817)) * `mysqld_multi` starts same instance multiple times with the risk to crash database ([MDEV-26910](https://jira.mariadb.org/browse/MDEV-26910)) * Valgrind/MSAN errors in `Item_func_des_encrypt::val_str` ([MDEV-27561](https://jira.mariadb.org/browse/MDEV-27561)) * Roles without grants are handled wrong ([MDEV-28743](https://jira.mariadb.org/browse/MDEV-28743)) * Unexpected ERROR: Found out of order GTID after replaying binlog read from remote ([MDEV-29803](https://jira.mariadb.org/browse/MDEV-29803)) * The server does not detect changes in NULL-ability of system table columns ([MDEV-30555](https://jira.mariadb.org/browse/MDEV-30555)) * Queries with window functions previously could not be killed during the processing of the window function; also the `max_statement_time` statement time for the execution of window functions was ignored; both of these behaviors are corrected ([MDEV-31209](https://jira.mariadb.org/browse/MDEV-31209)) * Using Query Cache (not default) with a "`ALTER TABLE tbl CONVERT TABLE normal_table TO partition_definition`" query, there was query cache invalidation of "`normal_table`" that accessed freed memory, potentially resulting undefined behaviour ([MDEV-33170](https://jira.mariadb.org/browse/MDEV-33170)) * Cannot modify a column if there is a generated column before it and a foreign key ([MDEV-35630](https://jira.mariadb.org/browse/MDEV-35630)) * Invalid access, use-after-free, on `rli->description_event_for_exec` ([MDEV-35691](https://jira.mariadb.org/browse/MDEV-35691)) * Galera SST aborted during its TLS certificate check when the node's certificate file bundled the leaf certificate with an intermediate CA and the CA file contained only the root, a common layout with certificates issued by cert-manager and similar PKIs (MDEV-35812); the check validated the leaf certificate directly against the CA file and could not complete the chain through the bundled intermediate; it now takes bundled intermediates into account, so such certificate chains verify correctly and the SST proceeds ([MDEV-35812](https://jira.mariadb.org/browse/MDEV-35812)) * MariaDB cannot open page-compressed InnoDB tables at startup if `innodb_compression_algorithm` other than zlib is specified ([MDEV-36147](https://jira.mariadb.org/browse/MDEV-36147)) * The rsync SST method of Galera worked incorrectly if `innodb_log_group_home_dir` or `aria_log_dir_path` were not the same as datadir at the SST donor node; this release has a fix for the rsync SST script to support varying data directory locations ([MDEV-36677](https://jira.mariadb.org/browse/MDEV-36677)) * Deleting from Aria table could result in a corrupt index on Windows ([MDEV-37000](https://jira.mariadb.org/browse/MDEV-37000)) * Partitioned tables now are named correctly on case insensitive filesystems have have predictable results when renaming and altering them ([MDEV-37739](https://jira.mariadb.org/browse/MDEV-37739)) * SHOW TABLES allows users with only GRANT OPTION privilege to read all table names in the database "mysql" ([MDEV-37951](https://jira.mariadb.org/browse/MDEV-37951)) * Server fails to drop .ibd file when vector table creation fails ([MDEV-38842](https://jira.mariadb.org/browse/MDEV-38842)) * Assertion `table->vers_write` fails upon ODKU into table with versioned column ([MDEV-38854](https://jira.mariadb.org/browse/MDEV-38854)) * Overlong database names were silently accepted, but truncated to 64 chars in GRANT statements (db level) ([MDEV-39047](https://jira.mariadb.org/browse/MDEV-39047)) * Check that plugin name is pure ASCII ([MDEV-39245](https://jira.mariadb.org/browse/MDEV-39245)) * Logical Bug in `NOT ( ... XOR ... )` Evaluation with Implicit Type Conversion ([MDEV-39363](https://jira.mariadb.org/browse/MDEV-39363)) * missing filename check in mariadb-backup --decompress ([MDEV-39565](https://jira.mariadb.org/browse/MDEV-39565)) * PROXY v2 protocol uninitialized memory reads ([MDEV-39576](https://jira.mariadb.org/browse/MDEV-39576)) * dynamic column header missing sanity checks ([MDEV-39581](https://jira.mariadb.org/browse/MDEV-39581)) * ASAN error on malformed WKB point ([MDEV-39657](https://jira.mariadb.org/browse/MDEV-39657)) * JSON functions added in 11.4 are now interruptible with a KILL QUERY, or exceeding the `max_statement_time`, including `JSON_ARRAY_INTERSECT`, `JSON_OBJECT_TO_ARRAY`, `JSON_SCHEMA_VALID`; the `JSON_KEY_VALUE` function as a quick function added isn't applicable; all the functions now produce warnings on invalid JSON passed to them ([MDEV-39742](https://jira.mariadb.org/browse/MDEV-39742)) * SHOW CREATE TABLE corrupts \`-quoted table options ([MDEV-39776](https://jira.mariadb.org/browse/MDEV-39776)) * 32-bit size truncation in RocksDB ([MDEV-39812](https://jira.mariadb.org/browse/MDEV-39812)) * `JSON_ARRAYAGG()` returns garbage because of off-by-one error ([MDEV-39817](https://jira.mariadb.org/browse/MDEV-39817)) * Backtick in FK names breaks `SHOW CREATE TABLE` ([MDEV-39818](https://jira.mariadb.org/browse/MDEV-39818)) * handlersocket plugin default secret is empty ([MDEV-39841](https://jira.mariadb.org/browse/MDEV-39841)) * Under `sql_mode=ONLY_FULL_GROUP_BY` when a correlated subquery aggregates a column of an outer query, the server previously incorrectly raised a `ER_WRONG_FIELD_WITH_GROUP` error rather than a correct result ([MDEV-39932](https://jira.mariadb.org/browse/MDEV-39932)) * An appropriately privileged user (with `SUPER` or `SYSTEM_VARIABLES_ADMIN` privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable `wsrep_sst_auth`, which can be modified at runtime, were not properly sanitized when used to construct a shell command ([MDEV-40027](https://jira.mariadb.org/browse/MDEV-40027)) * An appropriately privileged user (with `SUPER` privileges) could execute shell commands as the UID of the mariadbd process because the values of the system variable `wsrep_node_address`, which can be modified at runtime, were not properly sanitized when used to construct a shell command ([MDEV-40056](https://jira.mariadb.org/browse/MDEV-40056)) * Assertion `marked_for_read()` fails on slave upon RBR with unique blobs and `binlog_row_image=MINIMAL` #3 ([MDEV-40057](https://jira.mariadb.org/browse/MDEV-40057)) * use-of-uninitialized-value in `THD::print_aborted_warning(unsigned int, char const*)` ([MDEV-40103](https://jira.mariadb.org/browse/MDEV-40103)) * A use of uninitialised memory may have resulted in a range query on a system versioned table based on its versioning rows having an unpredictable query plan ([MDEV-40147](https://jira.mariadb.org/browse/MDEV-40147)) * `JSON_OVERLAPS`, `JSON_LENGTH`, `JSON_DEPTH`, `JSON_EQUALS`, `JSON_NORMALIZE` didn't response to `KILL` query or respect the `max_statement` time system variable; `JSON_EQUALS` and `JSON_NORMALIZE` now return warnings on incorrect syntax ([MDEV-40165](https://jira.mariadb.org/browse/MDEV-40165)) * `JSON_VALID` wasn't able to be stopped if a large document was passed to it; it also failed to respect the `max_statement_time`; in correcting the error handling of this function there is also an SQL note if the JSON is invalid indicating at what position it is invalid and why ([MDEV-40175](https://jira.mariadb.org/browse/MDEV-40175)) * Dynamic columns when reading an unsigned integer could overflow the 64 that was used as a shift counter ([MDEV-40200](https://jira.mariadb.org/browse/MDEV-40200)) * single quotes make SHOW CREATE USER invalid ([MDEV-40308](https://jira.mariadb.org/browse/MDEV-40308)) * mariadb-dump doesn't always quote identifiers ([MDEV-40311](https://jira.mariadb.org/browse/MDEV-40311)) * SHOW CREATE SERVER incorrect quoting ([MDEV-40312](https://jira.mariadb.org/browse/MDEV-40312)) * symlinked table name is not encoded ([MDEV-40358](https://jira.mariadb.org/browse/MDEV-40358)) * MyISAM/Aria silently truncate extensions from filenames, if too long ([MDEV-40395](https://jira.mariadb.org/browse/MDEV-40395)) * SFORMAT ignores `max_allowed_packet` ([MDEV-40411](https://jira.mariadb.org/browse/MDEV-40411)) * `ALTER TABLE ... CONVERT ... PARTITION` doesn't encode partition names ([MDEV-40413](https://jira.mariadb.org/browse/MDEV-40413)) * `GRANT PROXY` with empty password incorrectly checks grantor's privileges ([MDEV-40470](https://jira.mariadb.org/browse/MDEV-40470)) * Views now escape user names in the view frm file; old views where the definer name included a backslash will need to be recreated ([MDEV-40484](https://jira.mariadb.org/browse/MDEV-40484)) * ER\_TOO\_BIG\_FIELDLENGTH or assertion failure upon creating vector from blob ([MDEV-40486](https://jira.mariadb.org/browse/MDEV-40486)) * Galera metadata conflict locking might not look correct if `wsrep_debug=1` ([MDEV-40538](https://jira.mariadb.org/browse/MDEV-40538)) * A WKB multi-point with an invalid byte order field when passed to the function `ST_GeomFromWKB` has been corrected to return a NULL result where it previously had a valid value ([MDEV-40552](https://jira.mariadb.org/browse/MDEV-40552)) * A master could cause a replica to apply the same statement twice and end up with data the master's binary log never contained, by sending an event whose declared size disagrees with the amount of data actually sent; the replica stored such an event in its relay log as received, and a hidden second event in the surplus bytes was later applied as though the master had sent it; the replica now compares the two sizes on arrival, so a mismatched event stops the IO thread with an error and never reaches the relay log; this closes a gap that made a replica's data unverifiable against its master's binary log ([MDEV-40648](https://jira.mariadb.org/browse/MDEV-40648)) * `mysql_json` plugin OOB reads ([MDEV-40678](https://jira.mariadb.org/browse/MDEV-40678)) * `DROP PACKAGE` leaves `PACKAGE BODY` grant in `mysql.procs_priv` ([MDEV-40722](https://jira.mariadb.org/browse/MDEV-40722)) * InnoDB could fail to recover after being killed in a DDL operation. ([MDEV-40728](https://jira.mariadb.org/browse/MDEV-40728)) * CREATE ... SELECT VEC\_FROMTEXT(...) may create VECTOR columns that reject every value ([MDEV-40751](https://jira.mariadb.org/browse/MDEV-40751)) * Large memory allocations use `MAP_NORESERVE` where available (Linux and Illumos) to ensure that large memory mappings (e.g. 8TiB on default `innodb_buffer_pool_size_max`) do not result in memory actually being reserved (which it is by default on Illumos). --large-page memory behaviour isn't changed. ([MDEV-40921](https://jira.mariadb.org/browse/MDEV-40921)) * CREATE TABLE AS SELECT did not replicate correctly in Galera. ([MDEV-40929](https://jira.mariadb.org/browse/MDEV-40929)) ### Related to install and upgrade * Provide fallback message logging function when they are not present ([MDEV-38075](https://jira.mariadb.org/browse/MDEV-38075)) ### Related to performance * Fixed a performance regression in the oltp\_read\_write benchmark with transaction-isolation=READ-COMMITTED; regression introduced in 10.3 ([MDEV-21423](https://jira.mariadb.org/browse/MDEV-21423)) * InnoDB Encryption threads no longer busy-wait and now respond quickly for `innodb_encrypt_tables` and `innodb_encryption_rotate_key_age` ([MDEV-34358](https://jira.mariadb.org/browse/MDEV-34358)) * Hashicorp Key Management plugin improved performance by avoiding calling expensive time retrieval functions ([MDEV-37187](https://jira.mariadb.org/browse/MDEV-37187)) * Inlined the fast path for the disabled optimizer trace case, trading a function call for a predicted-branch on a hot path ([MDEV-39490](https://jira.mariadb.org/browse/MDEV-39490)) * Reduced buffer pool flushing contention under sustained write pressure ([MDEV-39600](https://jira.mariadb.org/browse/MDEV-39600)) * Reloading COSINE metric index from disk degrades search recall due to abs2 quantization noise ([MDEV-39858](https://jira.mariadb.org/browse/MDEV-39858)) * Improved lock granularity in lock\_move\_reorganize\_page() ([MDEV-40128](https://jira.mariadb.org/browse/MDEV-40128)) * Spin on each lock release to try to make releasing all transactional locks more robust to transients, reducing the probability of taking an exclusive latch later ([MDEV-40129](https://jira.mariadb.org/browse/MDEV-40129)) * Validation during json normalization has bee made inline for increased performance. ([MDEV-40174](https://jira.mariadb.org/browse/MDEV-40174)) * MEMORY tables incorrectly restart index scan on DELETE ([MDEV-40186](https://jira.mariadb.org/browse/MDEV-40186)) * btr\_page\_reorganize\_low() uses the buffer pool just to obtain a scratch block ([MDEV-40408](https://jira.mariadb.org/browse/MDEV-40408)) * lock\_move\_reorganize\_page() early exit check is useful only with lock elision ([MDEV-40427](https://jira.mariadb.org/browse/MDEV-40427)) * Fix memory leak for incorrect checksums in `mariadb-binlog --verify-binlog-checksum --force-read` ([MDEV-40544](https://jira.mariadb.org/browse/MDEV-40544)) ### Unexpected results * Name Resolution: Wrong result with grouping select from merged derived table ([MDEV-17846](https://jira.mariadb.org/browse/MDEV-17846)) * Error codes/messages reveal information about table structure ([MDEV-23086](https://jira.mariadb.org/browse/MDEV-23086)) * A WKB multi-line with an invalid byte order field when passed to in `ST_GeomFromWKB` has been corrected to return a NULL result where it previously had a valid value ([MDEV-26813](https://jira.mariadb.org/browse/MDEV-26813)) * Standard Deviation Calculations for `PROCEDURE_ANALYSE()` on will no longer overflow on large BIGINT columns until their calculation exceeds the maximum DOUBLE value ([MDEV-28374](https://jira.mariadb.org/browse/MDEV-28374)) * JSON functions on large input; `JSON_CONTAIN`, `JSON_CONTAINS_PATH`, `JSON_EXISTS`, `JSON_EXTRACT`, and `JSON_KEYS`; were previously uninterruptible with KILL query, and could exceed their maximum query time ([MDEV-28404](https://jira.mariadb.org/browse/MDEV-28404)) * The comparison of two JSON objects with `JSON_EQUALS`, `JSON_NORMALIZE`, or ordering, could result in unpredictable results where there was an object with the same object key listed more than once; the normalization has been made consistent ([MDEV-28922](https://jira.mariadb.org/browse/MDEV-28922)) * When fetching a false value from a JSON function using an SQL cursor, the "false" was truncated to "fals" due to an incorrect width in the protocol ([MDEV-31554](https://jira.mariadb.org/browse/MDEV-31554)) * `ALTER TABLE ... AUTO_INCREMENT = NN`; should return a Warning if it can not use the provided value ([MDEV-33660](https://jira.mariadb.org/browse/MDEV-33660)) * A WKB geometry, multi-polygon or geometry collection, with an invalid byte order field when passed to in `ST_GeomFromWKB` has been corrected to return a NULL result where it previously had a valid value ([MDEV-35595](https://jira.mariadb.org/browse/MDEV-35595)) * Unexpected collation when using `json_table` ([MDEV-36764](https://jira.mariadb.org/browse/MDEV-36764)) * `JSON_SCHEMA_VALID()` was returning incorrect result with JSON having array of objects. ([MDEV-38033](https://jira.mariadb.org/browse/MDEV-38033)) * Unary negation of `LONGTEXT`, wrong result under GROUP BY ([MDEV-38210](https://jira.mariadb.org/browse/MDEV-38210)) * `JSON_EXISTS` was permitted to exceeded the depth for JSON functions ([MDEV-39276](https://jira.mariadb.org/browse/MDEV-39276)) * Query with UNION fails in Oracle `sql_mode` with `ER_BAD_FIELD_ERROR`/`ER_UNKNOWN_TABLE` ([MDEV-39522](https://jira.mariadb.org/browse/MDEV-39522)) * Under --bootstrap mode, used in mariadb-install-db, an unwanted delay was removed and it now calls the plugin clean up functions ([MDEV-39585](https://jira.mariadb.org/browse/MDEV-39585)) * Remove deprecated `wsrep_causal_reads` as a configuration option from provided wsrep.cnf ([MDEV-39691](https://jira.mariadb.org/browse/MDEV-39691)) * When selecting the result of `JSON_ARRAY_INTERSECT` from a cursor, result fields were blank due to incorrect setting of the length ([MDEV-39716](https://jira.mariadb.org/browse/MDEV-39716)) * Crash when pushing "NOT a" condition from HAVING into WHERE ([MDEV-39916](https://jira.mariadb.org/browse/MDEV-39916)) * InnoDB system tablespace autoshrink fails when the tail extent is an empty `XDES_FREE_FRAG` extent ([MDEV-39963](https://jira.mariadb.org/browse/MDEV-39963)) * `ST_GEOMFROMGEOJSON` when passed a JSON object that specified its "type" after all of the other GeoJSON objects that define it would previously return NULL rather than the object ([MDEV-39981](https://jira.mariadb.org/browse/MDEV-39981)) * On the successful {{LOAD DATA LOCAL INFILE}} path, a {{BEFORE INSERT}} trigger can change a base column while a {{STORED}} generated column retains the value computed before that trigger change. The persisted row therefore violates its own generated-column expression. ([MDEV-40480](https://jira.mariadb.org/browse/MDEV-40480)) * `mariadb-binlog --force-read` now consistently displays the checksum for Unknown events to match “known” events ([MDEV-40542](https://jira.mariadb.org/browse/MDEV-40542)) * `KILL` checks user (not `priv_user`) and doesn't verify hostname ([MDEV-40554](https://jira.mariadb.org/browse/MDEV-40554)) * `ST_CROSSES` always returns 0 for geometries of different dimensions ([MDEV-40584](https://jira.mariadb.org/browse/MDEV-40584)) * `qc_info` OOB read if query contains \0 ([MDEV-40670](https://jira.mariadb.org/browse/MDEV-40670)) * Fix `ROLLUP` query results with empty result set. ([MDEV-40698](https://jira.mariadb.org/browse/MDEV-40698)) * MariaDB 11.4 Audit Plugin Changes `server_audit_syslog_ident` from Hyphen (-) to Underscore (\_) ([MENT-2862](https://jira.mariadb.org/browse/MENT-2862)) ## Changelog For the complete list of changes in this release, see the [changelog](/docs/release-notes/enterprise-server/11.8/changelog-11.8.9-6.md). ## Platforms In alignment to the enterprise lifecycle, MariaDB Enterprise Server 11.8.9-6 is provided for: * AlmaLinux 8 (x86\_64, ARM64) * AlmaLinux 9 (x86\_64, ARM64) * AlmaLinux 10 (x86\_64, ARM64) * Debian 11 (x86\_64, ARM64) * Debian 12 (x86\_64, ARM64) * Debian 13 (x86\_64, ARM64) * Oracle Linux 8 (x86\_64, ARM64) * Oracle Linux 9 (x86\_64, ARM64) * Oracle Linux 10 (x86\_64, ARM64) * Red Hat Enterprise Linux 8 (x86\_64, ARM64) * Red Hat Enterprise Linux 9 (x86\_64, ARM64, PPC64LE) * Red Hat Enterprise Linux 10 (x86\_64, ARM64) * Rocky Linux 8 (x86\_64, ARM64) * Rocky Linux 9 (x86\_64, ARM64) * Rocky Linux 10 (x86\_64, ARM64) * SUSE Linux Enterprise Server 15 (x86\_64, ARM64) * Ubuntu 22.04 (x86\_64, ARM64) * Ubuntu 24.04 (x86\_64, ARM64) * Ubuntu 26.04 (x86\_64, ARM64) * Microsoft Windows (x86\_64) (Without MariaDB Enterprise Cluster (Galera) support) * Red Hat UBI 8 (x86\_64, ARM64) * Red Hat UBI 8 is part of the Enterprise Server Docker Image. It does not support MariaDB Enterprise Cluster (Galera) or MariaDB ColumnStore. Some components of MariaDB Enterprise Server are supported on a subset of platforms. See [MariaDB Engineering Policies](https://mariadb.com/engineering-policies) for details. ## Installation Instructions * [Deploy MariaDB Enterprise with Repositories](/docs/server/server-management/install-and-upgrade-mariadb/mariadb-package-repository-setup-and-usage.md) * [Deploy MariaDB Enterprise with Package Tarballs](/docs/server/server-management/install-and-upgrade-mariadb/installing-mariadb/binary-packages/package-tarballs.md) * [Deploy MariaDB Enterprise with Docker](/docs/server/server-management/automated-mariadb-deployment-and-administration/docker-and-mariadb/deploy-mariadb-enterprise-server-with-docker.md) ## Upgrade Instructions * [Upgrade to MariaDB Enterprise Server 11.8](/docs/server/server-management/install-and-upgrade-mariadb/upgrading/upgrade-paths/mariadb-enterprise-server-11.8/upgrade-to-mariadb-enterprise-server-11.8.md) *This page is: Copyright © 2026 MariaDB. All rights reserved.* {% @marketo/form formid="4316" formId="4316" %}