{"schemaVersion":3,"id":"SUSE-SU-2026:22095-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for mariadb\n\nThis update for mariadb fixes the following issues\n\nUpdate to 11.8.8:\n\n- CVE-2026-3494: audit plugin comment handling bypass (bsc#1259176).\n- CVE-2026-34303: mysql: optimizer unspecified vulnerability (bsc#1266435).\n- CVE-2026-35549: SHA2 auth plugin crash on large packets (bsc#1261413).\n- CVE-2026-44168: wsrep SST unsafe parameter handling on the donor side (bsc#1266442).\n- CVE-2026-44169: authorization bypass in role-based routine-level privilege check exposes stored routine definitions\n  (bsc#1266441).\n- CVE-2026-44170: argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (bsc#1266440).\n- CVE-2026-44171: path traversal in mbstream (bsc#1266439).\n- CVE-2026-44172: mysql_real_escape_string() incorrectly handled big5 (bsc#1266438).\n- CVE-2026-44173: FILE privilege was not checked for subqueries in the FROM clause (bsc#1266437).\n- CVE-2026-48163: wsrep SST unsafe parameter handling on the donor side (bsc#1266815).\n- CVE-2026-48165: unsafe usage of `wsrep_sst_receive_address` values on the joiner side (bsc#1266814).\n- CVE-2026-49261: unsafe parameter handing in `wsrep_notify_cmd` (bsc#1267542).\n\n https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8\n https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8","dates":{"published":"2026-06-10T09:53:24.000Z","modified":"2026-06-16T18:24:40.652Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"mariadb&distro=SUSE Linux Enterprise Server 16.0","name":"mariadb","label":"mariadb&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/mariadb&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 11.8.8-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.8.8-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"mariadb&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"mariadb","label":"mariadb&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/mariadb&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 11.8.8-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.8.8-160000.1.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622095-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202622095-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1259176","label":"bugzilla.suse.com/1259176","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261413","label":"bugzilla.suse.com/1261413","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266435","label":"bugzilla.suse.com/1266435","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266437","label":"bugzilla.suse.com/1266437","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266438","label":"bugzilla.suse.com/1266438","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266439","label":"bugzilla.suse.com/1266439","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266440","label":"bugzilla.suse.com/1266440","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266441","label":"bugzilla.suse.com/1266441","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266442","label":"bugzilla.suse.com/1266442","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266814","label":"bugzilla.suse.com/1266814","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266815","label":"bugzilla.suse.com/1266815","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267542","label":"bugzilla.suse.com/1267542","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34303","label":"www.suse.com/security/cve/CVE-2026-34303","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3494","label":"www.suse.com/security/cve/CVE-2026-3494","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35549","label":"www.suse.com/security/cve/CVE-2026-35549","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44168","label":"www.suse.com/security/cve/CVE-2026-44168","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44169","label":"www.suse.com/security/cve/CVE-2026-44169","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44170","label":"www.suse.com/security/cve/CVE-2026-44170","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44171","label":"www.suse.com/security/cve/CVE-2026-44171","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44172","label":"www.suse.com/security/cve/CVE-2026-44172","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44173","label":"www.suse.com/security/cve/CVE-2026-44173","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48163","label":"www.suse.com/security/cve/CVE-2026-48163","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48165","label":"www.suse.com/security/cve/CVE-2026-48165","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49261","label":"www.suse.com/security/cve/CVE-2026-49261","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-34303","CVE-2026-3494","CVE-2026-35549","CVE-2026-44168","CVE-2026-44169","CVE-2026-44170","CVE-2026-44171","CVE-2026-44172","CVE-2026-44173","CVE-2026-48163","CVE-2026-48165","CVE-2026-49261"],"downstream":[],"duplicates":[],"related":["CVE-2026-34303","CVE-2026-3494","CVE-2026-35549","CVE-2026-44168","CVE-2026-44169","CVE-2026-44170","CVE-2026-44171","CVE-2026-44172","CVE-2026-44173","CVE-2026-48163","CVE-2026-48165","CVE-2026-49261"]},"timeline":[{"kind":"published","date":"2026-06-10T09:53:24.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-16T18:24:40.652Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T08:52:10.929Z","stale":false,"partial":false}}