mariadb - Debian Package Tracker

general

source: mariadb (main)
version: 1:11.8.8-1
maintainer: Debian MySQL Maintainers (archive) (DMD)
uploaders: Otto Kekäläinen [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1:10.11.18-0+deb12u1
old-p-u: 1:10.11.18-0+deb12u1
stable: 1:11.8.6-0+deb13u1
stable-p-u: 1:11.8.8-0+deb13u1
testing: 1:11.8.8-1
unstable: 1:11.8.8-1

versioned links

1:10.11.18-0+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:11.8.6-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:11.8.8-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:11.8.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libmariadb-dev (1 bugs: 0, 1, 0, 0)
libmariadb-dev-compat (2 bugs: 0, 2, 0, 0)
libmariadb3 (1 bugs: 0, 1, 0, 0)
libmariadbd-dev
libmariadbd19t64
mariadb-backup
mariadb-client (3 bugs: 0, 2, 1, 0)
mariadb-client-compat
mariadb-client-core (1 bugs: 0, 1, 0, 0)
mariadb-common
mariadb-plugin-connect
mariadb-plugin-connect-jdbc
mariadb-plugin-cracklib-password-check
mariadb-plugin-gssapi-client
mariadb-plugin-gssapi-server
mariadb-plugin-hashicorp-key-management
mariadb-plugin-mroonga (1 bugs: 0, 0, 1, 0)
mariadb-plugin-oqgraph
mariadb-plugin-provider-bzip2
mariadb-plugin-provider-lz4
mariadb-plugin-provider-lzma
mariadb-plugin-provider-lzo
mariadb-plugin-provider-snappy
mariadb-plugin-rocksdb
mariadb-plugin-s3
mariadb-plugin-spider
mariadb-server (9 bugs: 0, 5, 4, 0)
mariadb-server-compat
mariadb-server-core
mariadb-test
mariadb-test-data

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

The following paragraph isn't well formatted, skipping it: &lt;&lt; ==EOF==
# String "-11.8." needs to be in path as MariaDB releases several series in
# parallel (e.g 11.4, 10.11, 10.4, 10.3 etc) and uscan should check for updates
# only in the 11.8-series.
#
# Specifically use archive.mariadb.org because it supports https and the main
# page has a file listing suitable for scanning new releases.
# The archive.mariadb.org service is under MariaDB Foundation control and is the
# official source for new releases.
==EOF==

Created: 2026-02-19 Last update: 2026-08-04 12:00

lintian reports 64 warnings high

Lintian reports 64 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-25 Last update: 2026-06-27 05:00

4 bugs tagged patch in the BTS normal

The BTS contains patches fixing 4 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-08-04 16:00

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-49261: (needs triaging) MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

You can find information about how to handle this issue in the security team's documentation.

7 issues that should be fixed with the next stable update:

CVE-2026-44168: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-44169: MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-44171: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-44172: MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
CVE-2026-44173: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-48163: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
CVE-2026-48165: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Created: 2026-06-07 Last update: 2026-08-02 20:32

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-07-04] Accepted mariadb 1:11.8.8-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Lena Voytek)
[2026-07-04] Accepted mariadb 1:10.11.18-0+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Lena Voytek)
[2026-07-04] mariadb 1:11.8.8-1 MIGRATED to testing (Debian testing watch)
[2026-06-06] Accepted mariadb 1:11.8.8-1 (source) into unstable (Otto Kekäläinen)
[2026-04-16] mariadb 1:11.8.6-6 MIGRATED to testing (Debian testing watch)
[2026-04-13] Accepted mariadb 1:11.8.6-6 (source) into unstable (Otto Kekäläinen)
[2026-04-01] mariadb 1:11.8.6-5 MIGRATED to testing (Debian testing watch)
[2026-03-26] mariadb 1:11.8.6-4 MIGRATED to testing (Debian testing watch)
[2026-03-25] Accepted mariadb 1:11.8.6-5 (source) into unstable (Lena Voytek) (signed by: Otto Kekäläinen)
[2026-03-20] mariadb 1:11.8.6-3 MIGRATED to testing (Debian testing watch)
[2026-03-19] Accepted mariadb 1:11.8.6-4 (source) into unstable (Otto Kekäläinen)
[2026-03-12] Accepted mariadb 1:11.8.6-3 (source) into unstable (Otto Kekäläinen)
[2026-03-07] Accepted mariadb 1:11.8.6-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Otto Kekäläinen)
[2026-02-28] mariadb 1:11.8.6-2 MIGRATED to testing (Debian testing watch)
[2026-02-19] Accepted mariadb 1:11.8.6-2 (source) into unstable (Otto Kekäläinen)
[2026-02-08] Accepted mariadb 1:11.8.6-1 (source) into unstable (Otto Kekäläinen)
[2026-01-19] mariadb 1:11.8.5-4 MIGRATED to testing (Debian testing watch)
[2026-01-14] Accepted mariadb 1:11.8.5-4 (source) into unstable (Otto Kekäläinen)
[2025-12-20] mariadb 1:11.8.5-3 MIGRATED to testing (Debian testing watch)
[2025-12-17] Accepted mariadb 1:11.8.5-3 (source) into unstable (Otto Kekäläinen)
[2025-12-13] Accepted mariadb 1:11.8.5-3~exp3 (source) into experimental (Otto Kekäläinen)
[2025-12-12] Accepted mariadb 1:11.8.5-3~exp2 (source) into experimental (Otto Kekäläinen)
[2025-12-12] mariadb 1:11.8.5-2 MIGRATED to testing (Debian testing watch)
[2025-12-08] Accepted mariadb 1:11.8.5-3~exp1 (source) into experimental (Otto Kekäläinen)
[2025-12-06] Accepted mariadb 1:11.8.5-2 (source) into unstable (Otto Kekäläinen)
[2025-12-03] mariadb 1:11.8.5-1 MIGRATED to testing (Debian testing watch)
[2025-11-29] Accepted mariadb 1:11.8.5-1 (source) into unstable (Otto Kekäläinen)
[2025-08-30] Accepted mariadb 1:10.11.14-0+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Otto Kekäläinen)
[2025-08-29] Accepted mariadb 1:10.11.14-0+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Otto Kekäläinen)
[2025-08-29] Accepted mariadb 1:11.8.3-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Otto Kekäläinen)

bugs [bug history graph]

all: 32 36
RC: 1
I&N: 18 21
M&W: 12 13
F&P: 1
patch: 4

links

homepage
lintian (0, 64)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, 93)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:11.8.8-1