SQL Server 2019

Build history

• SQL Server 2019 CU29 + GDR SQL Server 2019 CU29 + GDR Security update

  KB5046860 Nov 12, 2024

  SQL OS closes two remote-code-execution paths

  The update fixes two SQL OS issues that might allow remote code execution on Windows SQL Server instances and addresses 31 Important-severity vulnerabilities.

  Check the newer update, KB5058722

  Cumulative updates for SQL Server 2019 end on February 28, 2025. Security updates continue until January 8, 2030.

  Key changes 31 CVEs · 2 changes

  • Fix SQL OS: Remote code execution might be possible on a SQL Server instance through a DLL planting technique; this update fixes the issue.
  • Fix SQL OS: A vulnerability in a SQL Server assembly might allow remote code execution; this update fixes the issue.
  • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 GDR SQL Server 2019 GDR Security update

  KB5046859 Nov 12, 2024

  SQL OS flaws that could let attackers run code are fixed

  The update fixes two SQL Server Engine problems that could let attackers run their own instructions on a server from another computer. It also addresses 31 vulnerabilities overall.

  Check the newer update, KB5058713

  SQL Server 2019 cumulative updates end February 28, 2025. Security updates are scheduled to continue through January 8, 2030.

  Key changes 31 CVEs · 2 changes

  • Fix SQL OS: A specially placed library file might let an attacker run their own instructions on a SQL Server instance from another computer; this p...
  • Fix SQL OS: A security weakness in a SQL Server software component might let an attacker run their own instructions on a server from another comput...
  • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU29 SQL Server 2019 CU29 Cumulative update

  KB5046365 Oct 31, 2024

  18 fixes included; SESSION_CONTEXT can misbehave in parallel plans

  Includes 18 fixes for SQL Server 2019. Queries using SESSION_CONTEXT might return incorrect results or generate access violation dumps in parallel plans.

  Check the newer update, KB5046860

  SQL Server 2019 cumulative updates are scheduled to end on February 28, 2025; security updates are scheduled to continue through January 8, 2030.

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 18 changes

  • New Integration Services: A digitally signed catalog file is added to support catalog signing for specified Attunity CDC assemblies.
  • New Replication: You can disable OLE DB streaming for the Replication Distribution Agent to avoid the described error.
  • New Search: Trace flag 7617 is available to skip dropping full-text index fragments marked for deletion during database recovery.

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU28 + GDR SQL Server 2019 CU28 + GDR Security update

  KB5046060 Oct 8, 2024

  VSS Writer backup failures remain; privilege flaw fixed

  Fixes an important SQL Server elevation-of-privilege vulnerability and a CDC issue. Backups of some virtual machines might still fail because of a SQL Server VSS Writer issue.

  Check the newer update, KB5046860

  SQL Server 2019 cumulative updates are scheduled to end February 28, 2025; security updates are scheduled to continue through January 8, 2030.

  Known issues: 1 open Organizations and IT administrators

  • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze

  Key changes 1 CVE · 1 change

  • Fix Replication: Change Data Capture (CDC) no longer has the functional issues introduced in the September GDR.
  • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 GDR SQL Server 2019 GDR Security update

  KB5046056 Oct 8, 2024

  Elevation-of-privilege flaw fixed; CDC problems corrected

  Fixes one Important SQL Server elevation-of-privilege vulnerability and corrects Change Data Capture functional issues introduced in the September GDR.

  Check the newer update, KB5046859

  SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.

  Key changes 1 CVE · 1 change

  • Fix Replication: Change Data Capture (CDC) no longer has the functional issues introduced in the September GDR.
  • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU28 + GDR SQL Server 2019 CU28 + GDR Security update

  KB5042749 Sep 10, 2024

  Twelve vulnerabilities patched; CDC and VSS backup issues remain

  Fixes 12 vulnerabilities, including 11 rated Important. After installing it, CDC capture jobs might fail and SQL Server VSS Writer might fail to create application-consistent backups.

  Check the newer update, KB5046060

  SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.

  Known issues: 2 open Organizations and IT administrators

  • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze
  • CDC capture job might fail if columns are missing in CDC change tables

  Key changes 12 CVEs · 3 changes

  • Improved Query Execution: PREDICT checks the MODEL parameter to help avoid errors caused by an incorrect model.
  • Improved Replication: CDC can lock down metadata definitions to block changes to data definitions.
  • Fix Temporal: Stored procedures that manage temporal tables correctly quote table and column names read from database metadata.

  Read update → Source: Microsoft ↗

• SQL Server 2019 GDR SQL Server 2019 GDR Security update

  KB5042214 Sep 10, 2024

  Machine Learning Services flaws addressed; CDC upgrades can fail

  Addresses 12 Important vulnerabilities, including flaws in Machine Learning Services. It also adds a CDC upgrade safeguard, but CDC databases with certain column names might encounter missing columns or restore and upgrade errors.

  Check the newer update, KB5046056

  Cumulative updates for SQL Server 2019 are scheduled to end on February 28, 2025.

  Known issues: 1 open

  • CDC capture job might fail if columns are missing in CDC change tables

  Key changes 12 CVEs · 3 changes

  • Improved Query Execution: PREDICT checks the MODEL parameter before running, helping avoid errors caused by an incorrect model.
  • Improved Replication: CDC gains a capability to block data-definition changes that could affect its metadata.
  • Fix Temporal: Stored procedures that manage temporal tables quote table and column names correctly when building internal SQL batches.

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU28 SQL Server 2019 CU28 Cumulative update

  KB5039747 Aug 1, 2024

  SESSION_CONTEXT errors in parallel plans; backup and patching issues

  CU28 adds 13 fixes, but queries using SESSION_CONTEXT in parallel plans might return incorrect results or trigger access violations. Two other listed issues are fixed in CU29.

  Check the newer update, KB5042749

  SQL Server 2019 cumulative updates are scheduled to end on February 28, 2025; security updates are scheduled to end on January 8, 2030.

  Known issues: 2 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans
  • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze

  Key changes 13 changes

  • Improved Analysis Services: Intel Threading Building Blocks assemblies are digitally signed with a Microsoft certificate.
  • Improved Command Line Tools: SQL Server 2019 container images use the new mssql-tools18 package and tools directory. The previous tools directory is phased out.
  • Improved SQL OS: A high-I/O-latency warning is logged less often, reducing excessive entries in the SQL Server error log.

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU27 + GDR SQL Server 2019 CU27 + GDR Security update

  KB5040948 Jul 9, 2024

  38 vulnerabilities addressed; unused setup components removed

  Addresses 38 Important-severity vulnerabilities and removes unused components from SQL Server Setup.

  Check the newer update, KB5042749

  SQL Server 2019 cumulative updates end on February 28, 2025.

  Key changes 38 CVEs · 1 change

  • Removed Stretch DB: Unused components are removed from SQL Server Setup.
  • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
  • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 GDR SQL Server 2019 GDR Security update

  KB5040986 Jul 9, 2024

  Unused Stretch DB components removed from Setup

  The update addresses 38 Important-severity vulnerabilities and removes unused Stretch DB components from Setup. It may require a restart.

  Check the newer update, KB5042214

  Cumulative updates for version 2019 end February 28, 2025; security updates are scheduled through January 8, 2030.

  Key changes 38 CVEs · 1 change

  • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
  • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
  • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU27 SQL Server 2019 CU27 Cumulative update

  KB5037331 Jun 13, 2024

  Thirteen fixes include availability group and logging changes

  Includes 13 fixes for SQL Server 2019. It also leaves an open issue where `SESSION_CONTEXT` queries in parallel plans might return incorrect results or cause access violations.

  Check the newer update, KB5040948

  SQL Server 2019 cumulative updates are scheduled to end February 28, 2025. Security updates are scheduled to continue through January 8, 2030.

  Known issues: 1 open Organizations and IT administrators

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 13 changes

  • New SQL OS: A warning is added to the error log when high I/O latencies are detected in Bufferpool Lazy Writer.
  • Improved High Availability and Disaster Recovery: The cluster log report includes performance monitor counters when a health check timeout is reported.
  • Fix Master Data Services: Using a domain account on a computer that is not a domain controller no longer causes the “Network path not found” error.

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU26 SQL Server 2019 CU26 Cumulative update

  KB5035123 Apr 11, 2024

  Parallel SESSION_CONTEXT queries can return incorrect results

  CU26 includes 23 fixes, but parallel queries using SESSION_CONTEXT might return incorrect results or cause access violations. It also introduces a lock-escalation regression that can cause error 1204.

  Check the newer update, KB5037331

  SQL Server 2019 cumulative updates end on February 28, 2025.

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 19 changes

  • New Query Execution: A new setting lets administrators limit the memory used to handle remote procedure call parameters.
  • New Search: The full-text filter usage event reports four additional input and output size measurements.
  • Improved Security Infrastructure: The number of extra user tokens created by SQL Server process views is limited when trace flag 4673 is used.

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU25 + GDR SQL Server 2019 CU25 + GDR Security update

  KB5036335 Apr 9, 2024

  Remote-code flaws addressed in ODBC and OLE DB drivers

  Addresses 38 Important vulnerabilities, including remote code execution flaws in the ODBC and OLE DB drivers for SQL Server.

  Check the newer update, KB5040948

  SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.

  Key changes 38 CVEs · 2 changes

  • Fix Microsoft ODBC Driver for SQL Server: Remote code execution vulnerabilities in the ODBC driver are addressed.
  • Fix Microsoft OLE DB Driver for SQL Server: Remote code execution vulnerabilities in the OLE DB driver are addressed.
  • CVSS 8.8 CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 GDR SQL Server 2019 GDR Security update

  KB5035434 Apr 9, 2024

  ODBC and OLE DB driver vulnerabilities addressed

  Addresses 38 vulnerabilities in SQL Server-related drivers and updates SQL Server 2019 to build 15.0.2110.4. A restart might be requested.

  Check the newer update, KB5040986

  Cumulative updates for SQL Server 2019 end on February 28, 2025; security updates continue until January 8, 2030.

  Key changes 38 CVEs · 2 changes

  • Improved SQL Server: SQL Server 2019 is updated to build 15.0.2110.4.
  • Fix ODBC Driver for SQL Server and OLE DB Driver for SQL Server: Remote code execution vulnerabilities in the SQL Server drivers are addressed.
  • CVSS 8.8 CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2019 CU25 SQL Server 2019 CU25 Cumulative update

  KB5033688 Feb 15, 2024

  Availability databases return in SSMS; parallel SESSION_CONTEXT remains risky

  Fixes 14 issues in SQL Server 2019, including missing availability databases in SSMS. Queries using SESSION_CONTEXT can still return incorrect results or trigger access violations in parallel plans.

  Check the newer update, KB5036335

  SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 14 changes

  • Improved High Availability and Disaster Recovery: Creating a read-scale availability group with a large number of databases is prevented to avoid a subsequent assertion failure.
  • Improved Query Execution: A mitigation reduces the chance of an assertion failure during some complex queries using large-value data types; it does not apply in...
  • Improved SQL OS: Compressed memory dumps use I/O more efficiently, limit excessive file-cache growth, and can make better use of available CPU cores.

  Read update → Source: Microsoft ↗