docker pull mariadb:12mariadb@sha256:d46e102fa8b9b72bfcdeb56f9dd538742092119dc8b11f31fe662605cd234cd9Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 8 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
ADD file:eed88e94d6aa7c9da62836e137f889e03988c1a6b237b0cedb6ca666dfaa98ea in / - 1 kB
RUN /bin/sh -c groupadd -r mysql && useradd -r -g mysql mysql --home-dir /var/lib/mysql && userdel --remove ubuntu # buildkit - 5.2 MB
RUN |1 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 /bin/sh -c set -eux; apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates gpg gpgv libjemalloc2 libtcmalloc-minimal4t64 pwgen tzdata xz-utils zstd ; savedAptMark="$(apt-mark showmanual)"; apt-get install -y --no-install-recommends dirmngr gpg-agent wget; rm -rf /var/lib/apt/lists/*; dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; wget -q -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArc - 116 B
RUN |1 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 /bin/sh -c mkdir /docker-entrypoint-initdb.d # buildkit - 331 B
RUN |3 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 MARIADB_VERSION=1:12.3.3+maria~ubu2404 REPOSITORY=http://archive.mariadb.org/mariadb-12.3.3/repo/ubuntu/ noble main main/debug /bin/sh -c set -e; echo "deb ${REPOSITORY}" > /etc/apt/sources.list.d/mariadb.list; { echo 'Package: *'; echo 'Pin: release o=MariaDB'; echo 'Pin-Priority: 999'; } > /etc/apt/preferences.d/mariadb # buildkit - 70 MB
RUN |3 GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 MARIADB_VERSION=1:12.3.3+maria~ubu2404 REPOSITORY=http://archive.mariadb.org/mariadb-12.3.3/repo/ubuntu/ noble main main/debug /bin/sh -c set -ex; { echo "mariadb-server" mysql-server/root_password password 'unused'; echo "mariadb-server" mysql-server/root_password_again password 'unused'; } | debconf-set-selections; apt-get update; mkdir -p /var/lib/mysql/mysql ; touch /var/lib/mysql/mysql/user.frm ; apt-get install -y --no-install-recommends mariadb-server-galera="$MARIADB_VERSION" mariadb-backup socat ; rm -rf /var/lib/apt/ - 4 kB
COPY healthcheck.sh /usr/local/bin/healthcheck.sh # buildkit - 8 kB
COPY docker-entrypoint.sh /usr/local/bin/ # buildkit
Known vulnerabilities
1Critical1 with a fix
25High25 with a fix
68Medium31 with a fix
10Low3 with a fix
1Unknown1 with a fix
105 findings across 155 packages; 61 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2025-68121crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | stdlibinstalled v1.24.6 | 1.24.13, 1.25.7, 1.26.0-rc.3 |
| High | CVE-2025-61726golang: net/url: Memory exhaustion in query parameter parsing in net/url | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| High | CVE-2025-61729crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | stdlibinstalled v1.24.6 | 1.24.11, 1.25.5 |
| High | CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates | stdlibinstalled v1.24.6 | 1.26.10, 1.27.3 |
| High | CVE-2026-25679net/url: Incorrect parsing of IPv6 host literals in net/url | stdlibinstalled v1.24.6 | 1.25.8, 1.26.1 |
| High | CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-32280crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32281crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32283crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal | stdlibinstalled v1.24.6 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| High | CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-56853net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56858html/template: golang: Go html/template: Cross-Site Scripting via pathological input | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56859encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56860net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56862crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| Medium | CVE-2025-47912net/url: Insufficient validation of bracketed IPv6 hostnames in net/url | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58183golang: archive/tar: Unbounded allocation when parsing GNU sparse map | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58185encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58187crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 | stdlibinstalled v1.24.6 | 1.24.9, 1.25.3 |
| Medium | CVE-2025-58188crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58189crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61723encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61724net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61725net/mail: Excessive CPU consumption in ParseAddress in net/mail | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61727golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs | stdlibinstalled v1.24.6 | 1.24.11, 1.25.5 |
| Medium | CVE-2025-61728golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| Medium | CVE-2025-61730crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| Medium | CVE-2026-27142html/template: URLs in meta content attribute actions are not escaped in html/template | stdlibinstalled v1.24.6 | 1.25.8, 1.26.1 |
| Medium | CVE-2026-32282golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
Showing the 40 most severe of 86 distinct vulnerabilities (105 findings, one per affected package).
Packages
- Debian packages
- 151
- Go modules
- 4
Image configuration
- Base OS
- Ubuntu 24.04
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-entrypoint.sh
- Command
- mariadbd
- Exposed ports
- 3306/tcp
- Image created
- 2026-10-26
- amd64 digest
- sha256:71541e69e0a1fbec2fa57d6b3b30d751c7847ca77ce66f5af4ffff48060c37c8
Other MariaDB tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:71541e69e0a1. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.