MariaDB 10.5, end of life since 24 June 2025

MariaDB 10.5.29 vulnerabilities

MariaDB 10.5.29 ships with Debian 11. The US National Vulnerability Database lists 2 vulnerabilities for this version, none of them critical. The MariaDB Foundation fixes flaws only in maintained releases. Distributions backport those fixes while they are supported and stop at end of life.

2known vulnerabilities
0critical
0high
0exploited in the wild

What you can do

Keep MariaDB 10.5.29, patched

We backport the security fixes to the MariaDB package of your distribution, or to the release you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.

Upgrade

Move to a maintained MariaDB release, such as 11.4 LTS, once your applications can make the jump. Our fixes keep you safe while you plan it.

Assess first

Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.

Request a server assessment

All 2 known vulnerabilities in MariaDB 10.5.29

US National Vulnerability Database, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where NVD records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Distribution builds may already include fixes for some of them.

CVE	Score	Severity	Published	Fixed in	Description
CVE-2026-35549	6.5	Medium	2026-04-03	11.4.10	An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.
CVE-2026-3494	4.3	Medium	2026-03-03	n/a	In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.