MariaDB 10.6 out of maintenance: six critical CVEs no longer patched

MariaDB Community Server 10.6 has reached end-of-life. The foundation confirmed this in a post published on 31 October 2026 on their website: following the closure of the maintenance cycle, security fixes released on 16 October are available for 10.11, 11.4, 11.8 and 12.3, but not for 10.6. Anyone running shared hosting and still deploying this branch in production remains permanently unprotected from any future security patches.\n\n## The dates that matter\n\nMariaDB had announced the closure of the 10.6 cycle with a dedicated notice: MariaDB Community Server 10.6 would reach end-of-support on 6 July 2026, with a final binary build expected by late July. The final build arrived on 13 August as 10.6.28, including patches available at that time. Any fix released after that point will no longer touch this branch.\n\nFour LTS Community releases remain maintained: 10.11 (until 16 February 2028), 11.4 (until 29 May 2029), 11.8 (until 4 June 2028) and 12.3 (until 29 May 2029).\n\n## The October flaws\n\nThe 16 October 2026 update round includes six vulnerabilities. Two carry a CVSS score of 9.9: CVE-2026-92262, a filename encoding bypass via legacy table prefix that enables direct file access, and CVE-2026-85746, a heap write overflow in the ST_AsText() function on nested GIS objects. Both are fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9 and 12.3.3—but that was the final opportunity for 10.6. A server still running an earlier build, such as 10.6.21 or 10.6.24, common on hosting images built years ago, is already exposed to the complete list.\n\n## How to upgrade\n\nThe migration from 10.6 to 11.8 or 12.3 is direct, with no intermediate stops at 10.11 or 11.4. No dump and reload is required: data files are upgraded in-place. On the practical side, a runbook for cPanel environments highlights a technical point not to skip: from version 10.8 onwards, the InnoDB redo log format changed, so the new server can read the data directory from the old version reliably only if the latter was shut down cleanly (innodb_fast_shutdown = 0), never with a kill or cold stop. Additionally, cPanel does not support downgrading the database engine: the only viable rollback is restoring from a backup that has already been verified with a restore test, not reinstalling the old packages over a data directory already opened by the new version.\n\nAdministrators managing a fleet of servers can check the version in use with SELECT VERSION() on each instance: anything below 10.11 means no active maintenance.\n