Grafana LFI on https://grafana.mariadb.org #1419213 Valid File and Path Handling – 2022-01-06 – 73 Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client #3788482 Valid Memory Corruption Critical 2026-09-08 – 51 Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking #3897914 Valid Memory Corruption High 2026-09-08 – 43 MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover #3876430 Valid Access Control High 2026-09-07 – 35 Connector/C Out-of-bounds read in `unpack_fields()` from short metadata field #3896671 Valid Memory Corruption – 2026-09-30 – 31 Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket #3872239 Valid Denial of Service Medium 2026-09-30 – 31 Path Traversal in mbstream Extract #3678395 Valid File and Path Handling High 2026-10-03 – 29 MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server Crash #3867363 Valid Denial of Service Medium 2026-10-07 – 23 Stack Buffer-Overflow in MariaDB Charset_collation_map_st::insert_or_replace() #3782405 Valid Memory Corruption – 2026-09-15 – 23 libmariadb ( mariadb-connector-c ): stack overflow via server-controlled field->length in prepared-statement codec #3766217 Valid Memory Corruption Medium 2026-10-04 – 23 SSRF on jira.mariadb.org #397402 Valid Server-Side Request Forgery – 2018-10-13 – 21 scripts loader (denial of service) vulnerability #690330 Valid Denial of Service – 2020-03-19 – 20 DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalation #3908943 Valid Access Control High 2026-10-07 – 19 Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser #3896507 Valid No weakness recorded Medium 2026-10-11 – 18 Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server #3769676 Valid Memory Corruption Medium 2026-09-03 – 18 Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables #3910393 Valid Memory Corruption – 2026-10-12 – 16 MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service #3867358 Valid Denial of Service Medium 2026-10-07 – 16 Heap Memory Disclosure via Integer Underflow in Item_func_json_arrayagg::cut_max_length in MariaDB Server #3771139 Valid Memory Corruption – 2026-09-15 – 16 CRLF injection at https://mariadb.org/. #476257 Valid Injection and Smuggling – 2019-02-21 – 16 Vulnerability Report - Missing Certificate Authority Authorization rule #392701 Valid Cryptography – 2018-11-11 – 16 Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read #3856148 Valid Memory Corruption Critical 2026-10-07 – 14 Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write #3836021 Valid Access Control High 2026-10-07 – 14 Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP #3781201 Valid Memory Corruption Medium 2026-10-07 – 14 Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failure #3896617 Valid Cryptography – 2026-11-04 – 12 Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB Server #3771144 Valid Memory Corruption – 2026-09-14 – 12 Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM) #3771147 Valid Memory Corruption – 2026-09-15 – 11 xmlrpc.php on mariadb.org can lead to DDOS and brute force attacks #386160 Valid Denial of Service – 2018-10-12 – 10 KILL authorization trusts the presented login name instead of the authenticated anonymous account #3897588 Valid Memory Corruption – 2026-09-07 – 9 Named pipe connection inteception #1019891 Valid Input Validation and Logic – 2020-12-17 – 9 Ubuntu/Debian installation method allows key poisoning and code execution for network attacker #639473 Valid Cryptography – 2020-01-21 – 9 Github wiki is editable by anyone #457009 Valid Access Control – 2018-12-10 – 9 vulnerable to Cross-site Request Forgery | Jira #392761 Valid Cross-Site Request Forgery – 2018-10-12 – 9 ACL cache collision lets a role inherit privileges from a same-named socket user #3889667 Valid Authentication Medium 2026-09-07 – 8 DATA / INDEX DIRECTORY Abuse #3849025 Valid No weakness recorded – 2026-10-07 – 8 Git Config #1176174 Valid No weakness recorded – 2021-05-27 – 8 smtp service vulnerable to POODLE SSLv3 #514421 Valid Cryptography – 2019-05-11 – 8 Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server #3920633 Valid Memory Corruption Medium 2026-11-04 – 7 Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds write #3871977 Valid Memory Corruption Medium 2026-10-12 – 7 CRLF injection on https://buildbot.mariadb.org #481512 Valid Injection and Smuggling – 2019-02-04 – 7 Connector/ODBC: MADB_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB_StmtExecute, so the next paramset reads out of bounds #3920647 Valid Memory Corruption Medium 2026-11-04 – 6 Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array Reallocation #3915935 Valid Memory Corruption High 2026-10-07 – 6 MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion #3909248 Valid Memory Corruption Medium 2026-09-07 – 6 Connector/C Out-of-bounds read from unterminated GSSAPI SPN in `parse_server_packet()` #3896684 Valid Memory Corruption – 2026-11-04 – 6 Privilege escalation via user controlled usernames / roles and views #3880451 Valid No weakness recorded – 2026-10-07 – 6 Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path #3872248 Valid Memory Corruption Medium 2026-10-12 – 6 r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de ) #3871740 Valid Denial of Service Medium 2026-10-12 – 6 [downloads.mariadb.org] CRLF injection in case of encoded query mark #490997 Valid Injection and Smuggling – 2019-02-14 – 6 Incorrect Permission Assignment for Critical Resource #394861 Valid Access Control – 2018-11-14 – 6 #mysql50# legacy alias / internal table collisions #3849051 Valid No weakness recorded – 2026-10-07 – 5 #mysql50# legacy alias / stale table cache identity mismatch #3849040 Valid No weakness recorded – 2026-10-07 – 5