Moderate Vulnerability in MariaDB: High Privilege Denial of Service and Server Crashes
Summary
ALSA-2026:6435: Moderate: mariadb:10.11 security update. Affects Judy across 2 version ranges.
< 1.0.5-18.module_el8.10.0+3794+c6a66d65
< 1.0.5-18.module_el8.10.0+3955+6534edaf
Fixed in 1.0.5-18.module_el8.10.0+3794+c6a66d65 or 1.0.5-18.module_el8.10.0+3955+6534edaf, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is a widely-used, multi-user, multi-threaded SQL database server that is binary compatible with MySQL. It is designed to handle large volumes of data and supports various storage engines, making it a popular choice for web applications and enterprise solutions. The recent vulnerabilities identified in MariaDB versions prior to 3:10.11.15 expose users to potential crashes and denial of service attacks, compromising the reliability and security of database operations.
Vulnerability Detail
The vulnerabilities stem from multiple issues within the MariaDB server, including a high privilege denial of service vulnerability (CVE-2025-21490) and crashes caused by empty backtrace logs (CVE-2023-52969), item direct view references (CVE-2023-52970), and other unspecified vulnerabilities. These issues can lead to service interruptions, data loss, and exploitation by malicious actors, significantly impacting the integrity and availability of database services.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update Judy-
< 1.0.5-18.module_el8.10.0+3794+c6a66d651.0.5-18.module_el8.10.0+3794+c6a66d65 -
< 1.0.5-18.module_el8.10.0+3955+6534edaf1.0.5-18.module_el8.10.0+3955+6534edaf
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit access to the MariaDB server by configuring firewall rules to restrict incoming connections. This can help mitigate the risk of exploitation until the package is updated. Additionally, consider disabling features that are not in use to reduce the attack surface.
Conclusion
In summary, the identified vulnerabilities in MariaDB pose significant risks to database operations, including potential crashes and denial of service. It is crucial for users to update their installations to the latest patched version to ensure the security and reliability of their database systems. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for Judy →
FAQ
The vulnerabilities include high privilege denial of service and server crashes due to various issues, which can disrupt database operations.
You can check your MariaDB version by running 'mysql --version' in your terminal. If it is below 3:10.11.15, it is recommended to update.
The vulnerabilities can lead to service interruptions, data loss, and exploitation by attackers, affecting the overall security and reliability of your database.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for Judy.
