{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "ELSCVE-134075: Fix CVE-2026-44172 - big5 mysql_real_escape_string mishandling (CONC-819)\n- ELSCVE-134076: Fix CVE-2026-44171 - mbstream insufficient path validation (MDEV-39408)\n- ELSCVE-134210: Fix CVE-2026-49261 - wsrep_notify.cc command injection (MDEV-39721)\n- ELSCVE-134087: Fix CVE-2026-48165 - wsrep SST variable validation (MDEV-39676)\n- ELSCVE-134198: Fix CVE-2026-44168 - wsrep unsafe parameter handling, mariabackup SST (MDEV-39413)\n- ELSCVE-134085: Fix CVE-2026-48163 - wsrep_sst_rsync.sh unsafe parameter handling (MDEV-39648)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/advisories/2026/clsa-2026_1787136469.json" } ], "tracking": { "current_release_date": "2026-08-27T15:01:06Z", "generator": { "date": "2026-08-27T15:01:06Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1787136469", "initial_release_date": "2026-08-19T10:47:51Z", "revision_history": [ { "date": "2026-08-19T10:47:51Z", "number": "1", "summary": "Initial version" }, { "date": "2026-08-27T15:01:06Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "cl-MariaDB106: Fix of 7 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-connect-engine@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-rocksdb-engine@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB-meta-client@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB-meta-devel@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB-meta@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-s3-engine@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-gssapi-server@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-libs@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-server@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product": { "name": "cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_id": "cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cl-MariaDB106-devel@10.6.20-1.el7.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64" }, "product_reference": "cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-13699", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-13699" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-37483", "url": "https://jira.mariadb.org/browse/MDEV-37483" }, { "category": "external", "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1025/", "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1025/" } ], "release_date": "2025-12-23T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-44168", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-44168" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-39413", "url": "https://jira.mariadb.org/browse/MDEV-39413" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25143", "url": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25145", "url": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33093", "url": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33412", "url": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33464", "url": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33481", "url": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33482", "url": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49522", "url": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44168", "url": "https://access.redhat.com/security/cve/CVE-2026-44168" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2488450", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488450" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json" } ], "release_date": "2026-06-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-49261", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-49261" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-39721", "url": "https://jira.mariadb.org/browse/MDEV-39721" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25143", "url": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25145", "url": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33093", "url": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33412", "url": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33464", "url": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33481", "url": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33482", "url": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49522", "url": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:52848", "url": "https://access.redhat.com/errata/RHSA-2026:52848" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54142", "url": "https://access.redhat.com/errata/RHSA-2026:54142" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-49261", "url": "https://access.redhat.com/security/cve/CVE-2026-49261" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json" } ], "release_date": "2026-06-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-44172", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-44172" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/CONC-819", "url": "https://jira.mariadb.org/browse/CONC-819" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30135", "url": "https://access.redhat.com/errata/RHSA-2026:30135" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:43505", "url": "https://access.redhat.com/errata/RHSA-2026:43505" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47772", "url": "https://access.redhat.com/errata/RHSA-2026:47772" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44172", "url": "https://access.redhat.com/security/cve/CVE-2026-44172" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json" } ], "release_date": "2026-06-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-44171", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-44171" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-39408", "url": "https://jira.mariadb.org/browse/MDEV-39408" } ], "release_date": "2026-06-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-48163", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48163" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-39648", "url": "https://jira.mariadb.org/browse/MDEV-39648" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25143", "url": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25145", "url": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33093", "url": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33412", "url": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33464", "url": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33481", "url": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33482", "url": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49522", "url": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-48163", "url": "https://access.redhat.com/security/cve/CVE-2026-48163" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json" } ], "release_date": "2026-06-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-48165", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48165" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-39676", "url": "https://jira.mariadb.org/browse/MDEV-39676" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25143", "url": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25145", "url": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33093", "url": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33412", "url": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33464", "url": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33481", "url": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33482", "url": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49522", "url": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-48165", "url": "https://access.redhat.com/security/cve/CVE-2026-48165" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json" } ], "release_date": "2026-06-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-19T10:47:51.749503Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469", "product_ids": [ "CloudLinux-7:cl-MariaDB-meta-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-client-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB-meta-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-connect-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-devel-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-gssapi-server-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-libs-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-rocksdb-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-s3-engine-0:10.6.20-1.el7.tuxcare.els2.x86_64", "CloudLinux-7:cl-MariaDB106-server-0:10.6.20-1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1787136469" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }