Description
MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mysql-dfsg | 4.0.24-10sarge2 | DSA-1079-1 |
| Debian 3.1 | mysql-dfsg-4.1 | 4.1.11a-4sarge3 | DSA-1073-1 |
| Debian 3.0 | mysql | 3.23.49-8.15 | DSA-1071-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.45-7.el5 | RHSA-2008:0364 |
| RHEL 4 | mysql +3 | 4.1.20-1.RHEL4.1 | RHSA-2006:0544 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | mysql +4 | 5.0.30-1.el4s1.1 | RHSA-2007:0083 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 | SUSE-RU-2023:3956-1 |
| SLES 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 | SUSE-RU-2023:3956-1 |
| SLES 12 SP5 | lz4 | 1.8.0-3.5.2 | SUSE-RU-2023:4991-1 |
| SLES 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 | SUSE-RU-2023:4991-1 |
| SLES 12 SP5 | mariadb104 | 10.4.30-8.5.46 | SUSE-RU-2023:4991-1 |
| SLES 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 | SUSE-RU-2023:4991-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 | SUSE-RU-2023:3956-1 |
| SLES for SAP 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 | SUSE-RU-2023:3956-1 |
| SLES for SAP 12 SP5 | lz4 | 1.8.0-3.5.2 | SUSE-RU-2023:4991-1 |
| SLES for SAP 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 | SUSE-RU-2023:4991-1 |
| SLES for SAP 12 SP5 | mariadb104 | 10.4.30-8.5.46 | SUSE-RU-2023:4991-1 |
| SLES for SAP 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 | SUSE-RU-2023:4991-1 |
| SLE HPC 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 | SUSE-RU-2023:3956-1 |
| SLE HPC 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 | SUSE-RU-2023:3956-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mariadb | 10.6.4-2.1 | openSUSE-SU-2024:11038-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- MySQL 5.0.18 - Query Logging Bypass EDB-27326 · remote · Feb 27, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- RHSA-2008:0364 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0544 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1071-1 mysql - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1073-1 mysql-dfsg-4.1 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1079-1 mysql-dfsg - several Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-RU-2023:4991-1 Recommended update for mariadb104 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11038-1 libmariadbd-devel-10.6.4-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2023:3956-1 Recommended update for mariadb104 SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2007:0083 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
References
- MDKSA-2006:064 vendor-advisory
- http://bugs.mysql.com/bug.php?id=17667
- oval:org.mitre.oval:def:9915 vdb-entry signature
- DSA-1079 vendor-advisory
- 19034 third-party-advisory
- 20060225 mysql <= 5.0.18 mailing-list
- http://rst.void.ru/papers/advisory39.txt
- USN-274-2 vendor-advisory
- 16850 vdb-entry
- 20241 third-party-advisory
- USN-274-1 vendor-advisory
- 1015693 vdb-entry
- 20333 third-party-advisory
- 19502 third-party-advisory
- 30351 third-party-advisory
- DSA-1071 vendor-advisory
- RHSA-2007:0083 vendor-advisory
- ADV-2006-0752 vdb-entry
- 20253 third-party-advisory
- 19814 third-party-advisory
- DSA-1073 vendor-advisory
- RHSA-2008:0364 vendor-advisory
- 20625 third-party-advisory
- mysql-query-log-bypass-security(24966) vdb-entry
- RHSA-2006:0544 vendor-advisory