CVE-2026-107817

MEDIUM 4.4CVE-2026-107817 · Published 09/10/2026 · updated 14/10/2026

Package	Affected versions	Patched versions
mariadb mariadb	`≥ 10.11.1, < 10.11.19≥ 10.6.1, < 10.6.28≥ 11.4.1, < 11.4.13≥ 11.8.1, < 11.8.9≥ 12.3.1, < 12.3.3≥ 13.0.1, < 13.0.2`	`10.11.1910.6.2811.4.1311.8.912.3.313.0.2`

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

References

MariaDB/server commit 851f524 · Patch
MariaDB/server release mariadb-10.11.19 · Release Notes
MariaDB/server release mariadb-10.6.28 · Release Notes
MariaDB/server release mariadb-11.4.13 · Release Notes
MariaDB/server release mariadb-11.8.9 · Release Notes
MariaDB/server release mariadb-12.3.3 · Release Notes
MariaDB/server release mariadb-13.0.2 · Release Notes
MariaDB/server security advisory · Vendor Advisory
jira.mariadb.org/browse/MDEV-40678 · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free