DockerState

Home › Databases, caches and queues › mariadb › 11.8

mariadb:11.8

The MariaDB relational database, tag 11.8, built on Ubuntu 24.04. Pushed to Docker Hub 5 days ago.

Critical 1High 25Medium 67Low 10Unknown 1Starts as root4 platforms

104 MBdownload (compressed)
334 MBunpacked on disk
8filesystem layers
154packages
5,596files
docker pull mariadb:11.8mariadb@sha256:c4124d1afa875e47f2892edf26b482fa54f796e2f342d3717a04ca091a22a9bd

Size per platform

Compressed download size on Docker Hub for each architecture.

  • ppc64le114 MB
  • s390x108 MB
  • amd64104 MB
  • arm64102 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/bin133 MB
  • /usr/lib/x86_64-linux-gnu85 MB
  • /usr/lib34 MB
  • /usr/sbin33 MB
  • /usr/share/perl19 MB
  • /usr/share/mariadb5.4 MB
  • /var/lib3.9 MB
  • /usr/share/doc2.6 MB
  • /usr/local/bin1.8 MB
  • /var/cache1.7 MB

Layers

The 8 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 30 MBADD file:eed88e94d6aa7c9da62836e137f889e03988c1a6b237b0cedb6ca666dfaa98ea in /
  2. 1 kBRUN /bin/sh -c groupadd -r mysql && useradd -r -g mysql mysql --home-dir /var/lib/mysql && userdel --remove ubuntu # buildkit
  3. 5.2 MBRUN |1 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 /bin/sh -c set -eux; apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates gpg gpgv libjemalloc2 libtcmalloc-minimal4t64 pwgen tzdata xz-utils zstd ; savedAptMark="$(apt-mark showmanual)"; apt-get install -y --no-install-recommends dirmngr gpg-agent wget; rm -rf /var/lib/apt/lists/*; dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; wget -q -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArc
  4. 116 BRUN |1 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 /bin/sh -c mkdir /docker-entrypoint-initdb.d # buildkit
  5. 332 BRUN |3 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 MARIADB_VERSION=1:11.8.9+maria~ubu2404 REPOSITORY=http://archive.mariadb.org/mariadb-11.8.9/repo/ubuntu/ noble main main/debug /bin/sh -c set -e; echo "deb ${REPOSITORY}" > /etc/apt/sources.list.d/mariadb.list; { echo 'Package: *'; echo 'Pin: release o=MariaDB'; echo 'Pin-Priority: 999'; } > /etc/apt/preferences.d/mariadb # buildkit
  6. 69 MBRUN |3 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 MARIADB_VERSION=1:11.8.9+maria~ubu2404 REPOSITORY=http://archive.mariadb.org/mariadb-11.8.9/repo/ubuntu/ noble main main/debug /bin/sh -c set -ex; { echo "mariadb-server" mysql-server/root_password password 'unused'; echo "mariadb-server" mysql-server/root_password_again password 'unused'; } | debconf-set-selections; apt-get update; mkdir -p /var/lib/mysql/mysql ; touch /var/lib/mysql/mysql/user.frm ; apt-get install -y --no-install-recommends mariadb-server="$MARIADB_VERSION" mariadb-backup socat ; rm -rf /var/lib/apt/lists/*
  7. 4 kBCOPY healthcheck.sh /usr/local/bin/healthcheck.sh # buildkit
  8. 8 kBCOPY docker-entrypoint.sh /usr/local/bin/ # buildkit

Known vulnerabilities

1Critical1 with a fix
25High25 with a fix
67Medium31 with a fix
10Low3 with a fix
1Unknown1 with a fix

104 findings across 154 packages; 61 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2025-68121crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption stdlibinstalled v1.24.6 1.24.13, 1.25.7, 1.26.0-rc.3
High CVE-2025-61726golang: net/url: Memory exhaustion in query parameter parsing in net/url stdlibinstalled v1.24.6 1.24.12, 1.25.6
High CVE-2025-61729crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate stdlibinstalled v1.24.6 1.24.11, 1.25.5
High CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates stdlibinstalled v1.24.6 1.26.10, 1.27.3
High CVE-2026-25679net/url: Incorrect parsing of IPv6 host literals in net/url stdlibinstalled v1.24.6 1.25.8, 1.26.1
High CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries stdlibinstalled v1.24.6 1.25.11, 1.26.4
High CVE-2026-32280crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building stdlibinstalled v1.24.6 1.25.9, 1.26.2
High CVE-2026-32281crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation stdlibinstalled v1.24.6 1.25.9, 1.26.2
High CVE-2026-32283crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages stdlibinstalled v1.24.6 1.25.9, 1.26.2
High CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal stdlibinstalled v1.24.6 1.25.12, 1.26.5, 1.27.0-rc.2
High CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header stdlibinstalled v1.24.6 1.25.11, 1.26.4
High CVE-2026-56853net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56858html/template: golang: Go html/template: Cross-Site Scripting via pathological input stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56859encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56860net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56862crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers stdlibinstalled v1.24.6 1.26.9, 1.27.2
High CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames stdlibinstalled v1.24.6 1.26.9, 1.27.2
High CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references stdlibinstalled v1.24.6 1.26.9, 1.27.2
Medium CVE-2025-47912net/url: Insufficient validation of bracketed IPv6 hostnames in net/url stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58183golang: archive/tar: Unbounded allocation when parsing GNU sparse map stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58185encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58187crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 stdlibinstalled v1.24.6 1.24.9, 1.25.3
Medium CVE-2025-58188crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58189crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61723encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61724net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61725net/mail: Excessive CPU consumption in ParseAddress in net/mail stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61727golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs stdlibinstalled v1.24.6 1.24.11, 1.25.5
Medium CVE-2025-61728golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip stdlibinstalled v1.24.6 1.24.12, 1.25.6
Medium CVE-2025-61730crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls stdlibinstalled v1.24.6 1.24.12, 1.25.6
Medium CVE-2026-27142html/template: URLs in meta content attribute actions are not escaped in html/template stdlibinstalled v1.24.6 1.25.8, 1.26.1
Medium CVE-2026-32282golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root stdlibinstalled v1.24.6 1.25.9, 1.26.2

Showing the 40 most severe of 86 distinct vulnerabilities (104 findings, one per affected package).

Packages

Debian packages
150
Go modules
4

Image configuration

Base OS
Ubuntu 24.04
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
docker-entrypoint.sh
Command
mariadbd
Exposed ports
3306/tcp
Image created
2026-10-26
amd64 digest
sha256:8a4a99eff981d95c3ab12d019b82fe59725fb7761f1f9a5f155bc3f025528f4f

Other MariaDB tags

mariadb:12339 MB unpacked · 105 MB downloadC 1H 25M 68L 10? 1

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:8a4a99eff981. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.