MariaDB: Schwachstelle ermöglicht Denial of Service und potenziell Codeausführung
WID-SEC-2026-0815 · first 23.03.2026 · updated 23.06.2026 · CVSS 8,5
What it is about
MariaDB ist ein relationales Datenbanksystem, das anwendungskompatibel mit MySQL ist. Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MariaDB ausnutzen, um einen Denial of Service Angriff durchzuführen, und potenziell um beliebigen Programmcode auszuführen.
Under what conditions?
Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service Angriff durchzuführen
- potenziell um beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- Red Hat Enterprise Linux
- SUSE Linux
- Oracle Linux
- SUSE openSUSE
- RESF Rocky Linux
- MariaDB MariaDB Server <11.4.10
- MariaDB MariaDB Server <11.8.6
- MariaDB MariaDB Server <12.2.2
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- MariaDB MariaDB Server 11.4.10
- MariaDB MariaDB Server 11.8.6
- MariaDB MariaDB Server 12.2.2
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- MariDB Security Advisory vom 2026-03-22 github.com
- EU Vulnerability Database vom 2026-03-22 euvd.enisa.europa.eu
- MariaDB Server Isuue vom 2026-03-22 jira.mariadb.org
- SUSE Security Update SUSE-SU-2026:1367-1 vom 2026-04-15 lists.suse.com
- openSUSE Security Update OPENSUSE-SU-2026:20629-1 vom 2026-04-28 lists.opensuse.org
- SUSE Security Update SUSE-SU-2026:21407-1 vom 2026-04-30 lists.suse.com
- PoC CVE-2026-32710 vom 2026-04-04 www.zeroday.cloud
- openSUSE Security Update OPENSUSE-SU-2026:10694-1 vom 2026-05-07 lists.opensuse.org
- Red Hat Security Advisory RHSA-2026:19182 vom 2026-05-20 access.redhat.com
- Red Hat Security Advisory RHSA-2026:19021 vom 2026-05-19 access.redhat.com
- Rocky Linux Security Advisory RLSA-2026:19182 vom 2026-05-28 errata.build.resf.org
- Oracle Linux Security Advisory ELSA-2026-19182 vom 2026-06-23 linux.oracle.com
CVE: CVE-2026-32710
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.