Connector/C++ aborts client process on server session-tracking packet via std::stoi #3890352 Valid Denial of Service Medium 2026-11-04 – 2 Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhere #3891779 Valid SQL Injection Medium 2026-11-04 – 2 Path Traversal CVE-2021-26086 CVE-2021-26085 #1369288 Duplicate File and Path Handling – 2021-11-05 – 3 Connector/C++ string escaper re-escapes its own output, enabling SQL injection #3890289 Valid SQL Injection Medium 2026-11-04 – 3 Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name #3891319 Valid Memory Corruption Medium 2026-11-04 – 3 Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call #3891337 Valid Memory Corruption Medium 2026-11-04 – 3 r2dbc-mariadb: server message accepted with no command in flight desynchronises the connection and serves one user's rows to another #3920629 Valid Information Disclosure Medium 2026-11-04 – 3 Path traversal in command line client #637840 Valid File and Path Handling – 2020-05-28 – 4 Exposed debug.log file leads to information disclosure #775504 Informative Information Disclosure – 2020-01-15 – 4 Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL #3890329 Valid SQL Injection Medium 2026-11-04 – 4 `SHOW [CREATE|GRANTS] ...` / `mariadb-dump` Unescaped SQL Generation #3848978 Valid SQL Injection – 2026-10-07 – 5 #mysql50# legacy alias / stale table cache identity mismatch #3849040 Valid No weakness recorded – 2026-10-07 – 5 #mysql50# legacy alias / internal table collisions #3849051 Valid No weakness recorded – 2026-10-07 – 5 Incorrect Permission Assignment for Critical Resource #394861 Valid Access Control – 2018-11-14 – 6 [downloads.mariadb.org] CRLF injection in case of encoded query mark #490997 Valid Injection and Smuggling – 2019-02-14 – 6 r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de ) #3871740 Valid Denial of Service Medium 2026-10-12 – 6 Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path #3872248 Valid Memory Corruption Medium 2026-10-12 – 6 Privilege escalation via user controlled usernames / roles and views #3880451 Valid No weakness recorded – 2026-10-07 – 6 Connector/C Out-of-bounds read from unterminated GSSAPI SPN in `parse_server_packet()` #3896684 Valid Memory Corruption – 2026-11-04 – 6 MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion #3909248 Valid Memory Corruption Medium 2026-09-07 – 6 Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array Reallocation #3915935 Valid Memory Corruption High 2026-10-07 – 6 Connector/ODBC: MADB_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB_StmtExecute, so the next paramset reads out of bounds #3920647 Valid Memory Corruption Medium 2026-11-04 – 6 CRLF injection on https://buildbot.mariadb.org #481512 Valid Injection and Smuggling – 2019-02-04 – 7 Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds write #3871977 Valid Memory Corruption Medium 2026-10-12 – 7 Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server #3920633 Valid Memory Corruption Medium 2026-11-04 – 7 smtp service vulnerable to POODLE SSLv3 #514421 Valid Cryptography – 2019-05-11 – 8 Git Config #1176174 Valid No weakness recorded – 2021-05-27 – 8 DATA / INDEX DIRECTORY Abuse #3849025 Valid No weakness recorded – 2026-10-07 – 8 ACL cache collision lets a role inherit privileges from a same-named socket user #3889667 Valid Authentication Medium 2026-09-07 – 8 vulnerable to Cross-site Request Forgery | Jira #392761 Valid Cross-Site Request Forgery – 2018-10-12 – 9 Github wiki is editable by anyone #457009 Valid Access Control – 2018-12-10 – 9 Ubuntu/Debian installation method allows key poisoning and code execution for network attacker #639473 Valid Cryptography – 2020-01-21 – 9 Named pipe connection inteception #1019891 Valid Input Validation and Logic – 2020-12-17 – 9 KILL authorization trusts the presented login name instead of the authenticated anonymous account #3897588 Valid Memory Corruption – 2026-09-07 – 9 xmlrpc.php on mariadb.org can lead to DDOS and brute force attacks #386160 Valid Denial of Service – 2018-10-12 – 10 Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM) #3771147 Valid Memory Corruption – 2026-09-15 – 11 Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB Server #3771144 Valid Memory Corruption – 2026-09-14 – 12 Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failure #3896617 Valid Cryptography – 2026-11-04 – 12 Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP #3781201 Valid Memory Corruption Medium 2026-10-07 – 14 Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write #3836021 Valid Access Control High 2026-10-07 – 14 Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read #3856148 Valid Memory Corruption Critical 2026-10-07 – 14 Vulnerability Report - Missing Certificate Authority Authorization rule #392701 Valid Cryptography – 2018-11-11 – 16 CRLF injection at https://mariadb.org/. #476257 Valid Injection and Smuggling – 2019-02-21 – 16 Heap Memory Disclosure via Integer Underflow in Item_func_json_arrayagg::cut_max_length in MariaDB Server #3771139 Valid Memory Corruption – 2026-09-15 – 16 MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service #3867358 Valid Denial of Service Medium 2026-10-07 – 16 Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables #3910393 Valid Memory Corruption – 2026-10-12 – 16 Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server #3769676 Valid Memory Corruption Medium 2026-09-03 – 18 Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser #3896507 Valid No weakness recorded Medium 2026-10-11 – 18 DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalation #3908943 Valid Access Control High 2026-10-07 – 19 scripts loader (denial of service) vulnerability #690330 Valid Denial of Service – 2020-03-19 – 20