Description
MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | mysql | 3.23.49-8.8 | DSA-562-2 |
Advisories 1
- DSA-562-2 mysql - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://lists.mysql.com/internals/16174
- RHSA-2004:611 vendor-advisory
- 12783 third-party-advisory
- DSA-562 vendor-advisory
- 20041125 [USN-32-1] mysql vulnerabilities mailing-list
- http://lists.mysql.com/internals/16173
- mysql-union-dos(17667) vdb-entry
- 101864 vendor-advisory
- 11357 vdb-entry
- CLA-2004:892 vendor-advisory
- RHSA-2004:597 vendor-advisory
- P-018 third-party-advisory government-resource
- http://lists.mysql.com/internals/16168
- GLSA-200410-22 vendor-advisory
- 2004-0054 vendor-advisory
- http://bugs.mysql.com/2408
- 1011606 vdb-entry
- http://mysql.bkbits.net:8080/mysql-3.23/diffs/myisammrg/myrg_open.c%401.15