Security update for mariadb

Announcement ID:	SUSE-SU-2026:2330-1
Release Date:	2026-06-10T07:39:59Z
Rating:	critical
References:	bsc#1259176 bsc#1261413 bsc#1266435 bsc#1266437 bsc#1266438 bsc#1266439 bsc#1266440 bsc#1266441 bsc#1266442 bsc#1266814 bsc#1266815 bsc#1267542
Cross-References:	CVE-2026-34303 CVE-2026-3494 CVE-2026-35549 CVE-2026-44168 CVE-2026-44169 CVE-2026-44170 CVE-2026-44171 CVE-2026-44172 CVE-2026-44173 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261
CVSS scores:	CVE-2026-34303 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-3494 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-3494 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2026-3494 ( NVD ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVE-2026-3494 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2026-35549 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-35549 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-35549 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-44168 ( SUSE ): 8.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE-2026-44168 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2026-44169 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-44169 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2026-44170 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2026-44171 ( SUSE ): 5.4 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-44171 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVE-2026-44172 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-44173 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L CVE-2026-44173 ( SUSE ): 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2026-48163 ( SUSE ): 8.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE-2026-48163 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2026-48165 ( SUSE ): 8.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE-2026-48165 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2026-49261 ( SUSE ): 9.4 CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE-2026-49261 ( SUSE ): 9.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products:	Galera for Ericsson 15 SP7 Server Applications Module 15-SP7 SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Real Time 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Package Hub 15 15-SP7

An update that solves 12 vulnerabilities can now be installed.

Description:

This update for mariadb fixes the following issues:

• CVE-2026-3494: audit plugin comment handling bypass (bsc#1259176).
• CVE-2026-34303: mysql: optimizer unspecified vulnerability (bsc#1266435).
• CVE-2026-35549: SHA2 auth plugin crash on large packets (bsc#1261413).
• CVE-2026-44168: wsrep SST unsafe parameter handling on the donor side (bsc#1266442).
• CVE-2026-44169: authorization bypass in role-based routine-level privilege check exposes stored routine definitions (bsc#1266441).
• CVE-2026-44170: argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (bsc#1266440).
• CVE-2026-44171: path traversal in mbstream (bsc#1266439).
• CVE-2026-44172: mysql_real_escape_string() incorrectly handled big5 (bsc#1266438).
• CVE-2026-44173: FILE privilege was not checked for subqueries in the FROM clause (bsc#1266437).
• CVE-2026-48163: wsrep SST unsafe parameter handling on the donor side (bsc#1266815).
• CVE-2026-48165: unsafe usage of wsrep_sst_receive_address values on the joiner side (bsc#1266814).
• CVE-2026-49261: unsafe parameter handling in wsrep_notify_cmd (bsc#1267542).

Changes for mariadb:

• Update to 11.8.8: https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8 https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
• Update to 11.8.7: https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7 https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Server Applications Module 15-SP7
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-2330=1
• SUSE Package Hub 15 15-SP7
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2330=1
• Galera for Ericsson 15 SP7
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP7-ERICSSON-2026-2330=1

Package List:

• Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
  • libmariadbd-devel-11.8.8-150700.3.15.1
  • mariadb-debugsource-11.8.8-150700.3.15.1
  • libmariadbd19-debuginfo-11.8.8-150700.3.15.1
  • mariadb-11.8.8-150700.3.15.1
  • mariadb-client-11.8.8-150700.3.15.1
  • libmariadbd19-11.8.8-150700.3.15.1
  • mariadb-client-debuginfo-11.8.8-150700.3.15.1
  • mariadb-debuginfo-11.8.8-150700.3.15.1
  • mariadb-tools-11.8.8-150700.3.15.1
  • mariadb-tools-debuginfo-11.8.8-150700.3.15.1
• Server Applications Module 15-SP7 (noarch)
  • mariadb-errormessages-11.8.8-150700.3.15.1
• SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
  • mariadb-debuginfo-11.8.8-150700.3.15.1
  • mariadb-debugsource-11.8.8-150700.3.15.1
  • mariadb-galera-11.8.8-150700.3.15.1
• Galera for Ericsson 15 SP7 (x86_64)
  • mariadb-debuginfo-11.8.8-150700.3.15.1
  • mariadb-debugsource-11.8.8-150700.3.15.1
  • mariadb-galera-11.8.8-150700.3.15.1

References:

• https://www.suse.com/security/cve/CVE-2026-34303.html
• https://www.suse.com/security/cve/CVE-2026-3494.html
• https://www.suse.com/security/cve/CVE-2026-35549.html
• https://www.suse.com/security/cve/CVE-2026-44168.html
• https://www.suse.com/security/cve/CVE-2026-44169.html
• https://www.suse.com/security/cve/CVE-2026-44170.html
• https://www.suse.com/security/cve/CVE-2026-44171.html
• https://www.suse.com/security/cve/CVE-2026-44172.html
• https://www.suse.com/security/cve/CVE-2026-44173.html
• https://www.suse.com/security/cve/CVE-2026-48163.html
• https://www.suse.com/security/cve/CVE-2026-48165.html
• https://www.suse.com/security/cve/CVE-2026-49261.html
• https://bugzilla.suse.com/show_bug.cgi?id=1259176
• https://bugzilla.suse.com/show_bug.cgi?id=1261413
• https://bugzilla.suse.com/show_bug.cgi?id=1266435
• https://bugzilla.suse.com/show_bug.cgi?id=1266437
• https://bugzilla.suse.com/show_bug.cgi?id=1266438
• https://bugzilla.suse.com/show_bug.cgi?id=1266439
• https://bugzilla.suse.com/show_bug.cgi?id=1266440
• https://bugzilla.suse.com/show_bug.cgi?id=1266441
• https://bugzilla.suse.com/show_bug.cgi?id=1266442
• https://bugzilla.suse.com/show_bug.cgi?id=1266814
• https://bugzilla.suse.com/show_bug.cgi?id=1266815
• https://bugzilla.suse.com/show_bug.cgi?id=1267542