MariaDB 10.11.19 for Debian 12 (DLA-4835-1): security fixes, a port 3306 exposure fix and trixie status

On 14 October 2026 the Debian LTS team published DLA-4835-1, updating MariaDB in Debian 12 (bookworm) to upstream 10.11.19. Besides six CVEs, it fixes a packaging regression from July 2026 that could make MariaDB listen on all interfaces. Debian 13 (trixie) has not received a matching update yet.

At a glance

What the update fixes

Six CVEs from Oracle's July 2026 MySQL advisories. They concern replication and the Performance Schema and are rated between 2.7 and 6.6 by Oracle; most need a highly privileged account, and CVE-2026-60747 needs local access to the host. Debian summarises them as allowing an authenticated attacker to cause denial of service, gain unauthorised read access and possibly take over the server or cluster.

Unwanted network exposure. The previous bookworm package, 10.11.18-0+deb12u1, enabled the mariadb.socket systemd unit on upgrade. As reported in Debian bug #1141976, systemd then listened on port 3306 on all interfaces, ignoring bind-address and a custom port, and some servers failed to start after a reboot because the port was taken. The maintainer confirms 10.11.19 no longer has this regression, but it does not shut down instances already running through the socket.

Later upstream CVEs. MariaDB's 10.11.19 release notes also list fixes for CVEs published in September and October 2026. Two are rated 9.9: CVE-2026-92262, where the legacy #mysql50# table-name prefix bypasses filename encoding and could lead to data exfiltration or code execution, and CVE-2026-85746, a buffer overflow in ST_AsText. Both need an authenticated database account. Debian's package is built from this upstream release, but on 31 October 2026 the Debian tracker had not yet marked these newer CVEs as fixed for bookworm, so follow the tracker page for Debian's own assessment.

Are you affected?

apt policy mariadb-server libmariadb3
systemctl is-enabled mariadb.socket
sudo ss -ltnp | grep 3306

On Debian 12, anything below 10.11.19-0+deb12u1 lacks the fixes. If is-enabled prints enabled and you never chose socket activation, or ss shows 3306 on * or 0.0.0.0 while your configuration binds to 127.0.0.1, you were hit by the July regression.

How to update (Debian 12)

A second report, bug #1151058, describes an upgrade from .18 to .19 that stalled when a client re-activated the old server through the socket mid-upgrade; it happened through unattended-upgrades. If the socket is enabled and you do not use it, disable it first; users in #1141976 report that disabling and masking it restores the configured address and port:

sudo systemctl disable --now mariadb.socket
sudo systemctl mask mariadb.socket
sudo apt update
sudo apt install --only-upgrade mariadb-server mariadb-client libmariadb3

A plain sudo apt upgrade works too and also updates plugins such as mariadb-plugin-connect and mariadb-backup.

Restart or reboot?

No reboot is needed; the package restarts mariadb. Afterwards, check that only one server process runs and that it listens where you expect:

pgrep -a mariadbd
sudo ss -ltnp | grep mariadbd
sudo mariadb -e 'SELECT VERSION();'

If an old instance is still running, wait until it has shut down, then sudo systemctl restart mariadb, as the Debian maintainer advises in the bug report.

Debian 13 (trixie) in the meantime

Trixie ships MariaDB 11.8.6. The tracker marks the six July CVEs as minor issues with no DSA planned, and lists the October batch as open; MariaDB's patched version for the 11.8 series is 11.8.9. Until Debian ships a fix, reduce exposure: keep port 3306 closed to the internet, give application accounts only the privileges they need (no FILE or CREATE USER), and remove plugins you do not use, such as mariadb-plugin-connect, which is involved in CVE-2026-107815 and CVE-2026-85985.

Sources

• security-tracker.debian.org/tracker/DLA-4835-1
• lists.debian.org/debian-lts-announce/2026/10/msg00029.html
• security-tracker.debian.org/tracker/source-package/mariadb
• security-tracker.debian.org/tracker/CVE-2026-92262
• security-tracker.debian.org/tracker/CVE-2026-60585
• bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141976
• bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151058
• mariadb.com/docs/release-notes/community-server/10.11/10.11.19
• github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h
• github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx
• cve.org/CVERecord?id=CVE-2026-92262
• cve.org/CVERecord?id=CVE-2026-85746
• cve.org/CVERecord?id=CVE-2026-60585
• cve.org/CVERecord?id=CVE-2026-60747
• cve.org/CVERecord?id=CVE-2026-107815
• cve.org/CVERecord?id=CVE-2026-85985
• packages.debian.org/source/bookworm/mariadb
• cisa.gov/known-exploited-vulnerabilities-catalog
• debian.org/releases