OESA-2026-2734

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2734
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-2734.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2026-2734
Upstream
Published
2026-06-24T13:13:36Z
Modified
2026-06-24T13:30:12.135931715Z
Summary
mariadb security update
Details

Security Fix(es):

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2025-30693)

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Client accessible data as well as unauthorized update, insert or delete access to some of MySQL Client accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).(CVE-2025-30722)

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrep_notify_cmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable wsrep_notify_cmd.(CVE-2026-49261)

Database specific 
{
    "severity": "Critical"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / mariadb

Package

Name
mariadb
Purl
pkg:rpm/openEuler/mariadb&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.5.29-5.oe2403sp1

Ecosystem specific 

{
    "x86_64": [
        "mariadb-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-backup-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-common-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-config-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-debuginfo-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-debugsource-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-devel-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-embedded-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-embedded-devel-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-errmsg-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-gssapi-server-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-oqgraph-engine-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-pam-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-server-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-server-galera-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-server-utils-10.5.29-5.oe2403sp1.x86_64.rpm",
        "mariadb-test-10.5.29-5.oe2403sp1.x86_64.rpm"
    ],
    "src": [
        "mariadb-10.5.29-5.oe2403sp1.src.rpm"
    ],
    "aarch64": [
        "mariadb-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-backup-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-common-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-config-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-debuginfo-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-debugsource-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-devel-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-embedded-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-embedded-devel-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-errmsg-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-gssapi-server-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-oqgraph-engine-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-pam-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-rocksdb-engine-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-server-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-server-galera-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-server-utils-10.5.29-5.oe2403sp1.aarch64.rpm",
        "mariadb-test-10.5.29-5.oe2403sp1.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-2734.json"