Security

SECURITY.md

Security Policy

To report security vulnerabilities, please follow our special security policy. Do not report security issues in the public issue tracker.

mysql_json plugin OOB reads
GHSA-89ph-64cf-gqcc published Sep 7, 2026 by vuvova

Moderate
`qc_info` plugin can do OOB reads if query contains \0
GHSA-wfqg-88r5-55f6 published Sep 7, 2026 by vuvova

Moderate
one byte OOB write in DOS tables of the CONNECT engine
GHSA-4wgx-ffg9-jrwq published Sep 7, 2026 by vuvova

High
environment injection via wsrep bootstrap in the mariadb.service file
GHSA-mhvc-vqcq-7vq5 published Sep 7, 2026 by vuvova

High
libmariadb allowed cleartext password leakage on TLS hostname verification failure
GHSA-fmq9-qjxj-qpf7 published Sep 7, 2026 by vuvova

Moderate
insufficient validation of binary frm data when opening a table
GHSA-c4gx-34mg-95q5 published Sep 7, 2026 by vuvova

High
database privilege escalation via user / role name collision in the acl cache
GHSA-2m85-2x26-36rf published Sep 7, 2026 by vuvova

Moderate
privilege escalation via incorrect view frm parsing
GHSA-g2q2-3936-cp37 published Sep 7, 2026 by vuvova

High
Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
GHSA-h4vr-wpff-jfx4 published Sep 7, 2026 by vuvova

High
GRANT PROXY with empty password incorrectly checks grantor's privileges
GHSA-625w-4hgq-qwmr published Sep 7, 2026 by vuvova

High

Learn more about advisories related to MariaDB/server in the GitHub Advisory Database