{"id":"CVE-2026-107815","title":"MariaDB server is a community developed fork of MySQL server","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null w…","severity":"high","cvss":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-787"],"published":"2026-10-09","updated":"2026-10-09","sourceUpdated":"2026-10-09T17:41:29.727","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","references":[{"url":"https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","label":"security-advisories@github.com"},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","label":"security-advisories@github.com"},{"url":"https://jira.mariadb.org/browse/MDEV-40637","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107815.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107815"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548718"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107815"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-10-09T18:07:39.416Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","hardened_images","openstack_platform_13_queens"],"scores":{"nvd":8.5,"vendor":7.5},"slug":"CVE-2026-107815","body":"## Overview\n\nMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107815.json)","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}