Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
MariaDB 11.8 may allow execution of malicious code
published 17 days ago
Summary
The MariaDB 11.8 packages for AlmaLinux (including server, backup, client utilities, common files, and development libraries) contain a flaw in the text‑pattern library that could let specially crafted input corrupt memory and run unauthorized code. This could let an attacker take control of the database server if they can influence the data it processes. Apply the latest MariaDB 11.8 security update as soon as possible to fix the problem.
What to do
- Update almalinux mariadb11.8 to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-backup to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-client-utils to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-common to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-devel to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-embedded to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-embedded-devel to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-errmsg to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-gssapi-server to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-oqgraph-engine to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-pam to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-server to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-server-galera to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-server-utils to version 3:11.8.8-2.el10_2.alma.2.
- Update almalinux mariadb11.8-test to version 3:11.8.8-2.el10_2.alma.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | mariadb11.8 |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-backup |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-client-utils |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-common |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-devel |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-embedded |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-embedded-devel |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-errmsg |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-gssapi-server |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-oqgraph-engine |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-pam |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-server |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-server-galera |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-server-utils |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
| AlmaLinux:10 | almalinux | mariadb11.8-test |
< 3:11.8.8-2.el10_2.alma.2 Fix: upgrade to 3:11.8.8-2.el10_2.alma.2
|
Original advisory text
Important: mariadb11.8 security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.
Security Fix(es):
* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)
* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)
* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)
* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)
* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:84799 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-103111 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-86145 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-89161 Third Party Advisory
- https://bugzilla.redhat.com/2528993 Third Party Advisory
- https://bugzilla.redhat.com/2531747 Third Party Advisory
- https://bugzilla.redhat.com/2543797 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-84799.html Vendor Advisory
Timeline
Published19 Oct 2026
Updated22 Oct 2026
First seen22 Oct 2026
Sources
ALSA-2026:84799 · OSV
Track software like this
Free during beta