6.0.1 Secure release notes

What's new

Liquibase Secure 6.0.1 is a security and maintenance release built on 6.0.0. It removes compromised eMudhra certificate authorities from the Java runtimes that ship with Liquibase Secure, updates third-party dependencies to resolve known vulnerabilities, and fixes Java heap space errors on large schemas. It contains no other changes from 6.0.0.

Compromised eMudhra certificates removed

CVE-2026-91403 and CVE-2026-114820 concern certificate authorities operated by eMudhra. Liquibase Secure 6.0.1 removes the affected root certificates from the Java runtime bundled with the Liquibase Secure Docker image and the Windows installer, and from the Liquibase Secure Server migrate container.

Note: If you run the Liquibase Secure Docker image, upgrade to 6.0.1 to remove these certificates. If you installed Liquibase Secure from the ZIP or TAR file, it uses your own Java installation, so update that Java installation through its vendor. To remove the certificates without upgrading, on Windows, Linux, or macOS, see Remediate CVE-2026-91403 and CVE-2026-114820 in the Liquibase Secure Java runtime.

No more Java heap space errors on large schemas

Commands that check Liquibase's tracking tables, such as update, status, update-sql, validate and list-locks, no longer run out of Java heap space on large Oracle, SQL Server, DB2, MySQL and MariaDB schemas. Issues were detected for users in limited contexts, such as processing 400k+ columns with Java heaps less than 1.5 GB. Liquibase 6.0.1 re-writes how tracking tables are processed.

Security vulnerability report

This release includes updates to internal platform components and third-party dependencies to address known security vulnerabilities and strengthen the overall platform security posture of Liquibase Secure. These updates help organizations maintain secure deployment environments, improve compliance readiness, and reduce operational risk associated with outdated software components.

CVE summary

• CVE-2026-91403 and CVE-2026-114820: Removed the compromised eMudhra root certificates from the bundled Java runtime and the Liquibase Secure Server migrate container.

• CVE-2026-86597: Updated snowflake-jdbc from 4.3.3 to 4.3.4.

• CVE-2026-119210, CVE-2026-119276, CVE-2026-119280, and CVE-2026-119281: Updated mariadb-java-client from 3.5.10 to 3.5.11.

• CVE-2026-78663: Updated Liquibase Package Manager (LPM) in the Docker image to 0.3.8.

Liquibase Secure also includes VEX (Vulnerability Exploitability eXchange) files with every release to communicate Liquibase’s official assessment of reported CVEs. Refer to the VEX file included with the 6.0.1 release (files ending in .vex.json) for the complete list of vulnerability assessments and exploitability status. For more information about VEX files and how to interpret their status values, see the VEX documentation.

Full list of changes