MariaDB security note

What changed

• CVE-2026-119281 — Check if you run it

  MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

  Seen in 3.0.0 → 3.3.7 · 3 other packages on the advisory

• CVE-2026-119210 — Check if you run it

  MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

  Seen in 3.0.0 → 3.3.7 · 3 other packages on the advisory

• CVE-2026-119276 — Check if you run it

  MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

  Seen in 3.0.0 → 3.3.7 · 3 other packages on the advisory

• CVE-2026-119279 — Check if you run it

  MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

  Seen in 3.0.0 → 3.3.7 · 3 other packages on the advisory

• CVE-2026-119280 — Check if you run it

  MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

  Seen in 3.0.0 → 3.3.7 · 3 other packages on the advisory

• CVE-2026-101637 — Check if you run it

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).

  Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory

• CVE-2026-101629 — Check if you run it

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).

  Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory

• CVE-2026-101756 — Check if you run it

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS).

  Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory

What we still do not know

Every changed record in this note has a version range.