This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-3494 →

DEBIAN-CVE-2026-3494

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL,...

Original description

The description as published by the source.

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 mariadb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.11.18-0+deb12u1"}]}]

Debian:13 mariadb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.8.6-0+deb13u1"}]}]

Debian:14 mariadb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.8.6-1"}]}]

References

advisory security-tracker.debian.org