Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | MySQL Server | 8.4.0-8.4.10, 9.7.0-9.7.1 | — |
| Oracle | MySQL Cluster | 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mariadb | 1:11.8.9+ds-1 | — |
| Debian 13 | mariadb | No fix yet | — |
| Debian 12 | mariadb | 10.11.19-0+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mariadb | No fix yet | — |
| Ubuntu 26.04 LTS | mariadb | No fix yet | — |
| Ubuntu 26.04 LTS | mysql-8.4 | 8.4.11-0ubuntu0.26.04.1 | USN-8700-1 |
| Ubuntu 24.04 LTS | mariadb | No fix yet | — |
| Ubuntu 24.04 LTS | mysql-8.0 | 8.0.46-0ubuntu0.24.04.4 | USN-8700-1 |
| Ubuntu 22.04 LTS | mariadb-10.6 | No fix yet | — |
| Ubuntu 22.04 LTS | mysql-8.0 | 8.0.46-0ubuntu0.22.04.4 | USN-8700-1 |
| Ubuntu 20.04 LTS | mariadb-10.3 | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | mariadb-10.1 | No fix yet | — |
| Ubuntu 16.04 LTS | mariadb-10.0 +2 | No fix yet | — |
| Ubuntu 14.04 LTS | mysql-5.5 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | mysql-8.0 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | mysql-5.7 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | mysql-5.7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | mysql8.4 +7 | 8.4.11-1.el10_2 | RHSA-2026:56007 |
| RHEL 9 | mecab +1 | 0.996-3.module+el9.8.0+24348+9b27f387.4 | RHSA-2026:56973 |
| RHEL 9 | mecab-ipadic +1 | 2.7.0.20070801-24.module+el9.8.0+24348+9b27f387 | RHSA-2026:56973 |
| RHEL 9 | mysql +7 | 8.4.11-1.module+el9.8.0+24663+27effc5a | RHSA-2026:56973 |
| RHEL 9 | perl-DBD-MySQL | 4.053-3.module+el9.8.0+24348+9b27f387 | RHSA-2026:56973 |
| RHEL 9 | rapidjson +2 | 1.1.0-19.module+el9.8.0+24348+9b27f387 | RHSA-2026:56973 |
| RHEL 8 | mecab +1 | 0.996-2.module+el8.10.0+23550+bd321b9a | RHSA-2026:56936 |
| RHEL 8 | mecab-ipadic +1 | 2.7.0.20070801-17.module+el8.10.0+23550+bd321b9a | RHSA-2026:56936 |
| RHEL 8 | mysql +7 | 8.4.11-1.module+el8.10.0+24662+2d989aa9 | RHSA-2026:56936 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | mysql8.4 +7 | 8.4.11-1.el10_2.alma.1 | ALSA-2026:56007 |
| AlmaLinux 9 | mecab +1 | 0.996-3.module_el9.6.0+152+8cbce00c.4 | ALSA-2026:56973 |
| AlmaLinux 9 | mecab-ipadic +1 | 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c | ALSA-2026:56973 |
| AlmaLinux 9 | mysql +7 | 8.4.11-1.module_el9.8.0+295+1681b9df | ALSA-2026:56973 |
| AlmaLinux 9 | perl-DBD-MySQL | 4.053-3.module_el9.8.0+235+a38ba90c | ALSA-2026:56973 |
| AlmaLinux 9 | rapidjson-doc +1 | 1.1.0-19.module_el9.6.0+152+8cbce00c | ALSA-2026:56973 |
| AlmaLinux 8 | mecab +1 | 0.996-2.module_el8.10.0+4060+d4256e26 | ALSA-2026:56936 |
| AlmaLinux 8 | mecab-ipadic +1 | 2.7.0.20070801-17.module_el8.10.0+4060+d4256e26 | ALSA-2026:56936 |
| AlmaLinux 8 | mysql +7 | 8.4.11-1.module_el8.10.0+4255+e01a855c | ALSA-2026:56936 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | mysql8.4 | 8.4.11-1.el10_2.rocky.0.1 | RLSA-2026:56007 |
| Rocky Linux 9 | mecab | 0.996-3.module+el9.8.0+40162+a76274f1.4 | RLSA-2026:56973 |
| Rocky Linux 9 | mecab-ipadic | 2.7.0.20070801-24.module+el9.8.0+40162+a76274f1 | RLSA-2026:56973 |
| Rocky Linux 9 | perl-DBD-MySQL | 4.053-3.module+el9.8.0+40162+a76274f1 | RLSA-2026:56973 |
| Rocky Linux 9 | rapidjson | 1.1.0-19.module+el9.8.0+40162+a76274f1 | RLSA-2026:56973 |
| Rocky Linux 8 | mecab | 0.996-2.module+el8.10.0+1676+9b4b6e24 | RLSA-2026:56936 |
| Rocky Linux 8 | mecab-ipadic | 2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83 | RLSA-2026:56936 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mariadb | 12.3.2-3.1 | openSUSE-SU-2026:12245-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | mariadb | 11.8.9-r0 | — |
| Alpine v3.23 | mariadb | 11.4.13-r0 | — |
| Alpine v3.22 | mariadb | 11.4.13-r0 | — |
| Alpine v3.21 | mariadb | 11.4.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | mariadb1011 +15 | 3:10.11.19-1.amzn2023.0.1 | ALAS2023-2026-3308, ALAS2023-2026-3198 |
| Amazon Linux 2023 | mariadb114 +15 | 3:11.4.13-1.amzn2023.0.1 | ALAS2023-2026-3309, ALAS2023-2026-3199 |
| Amazon Linux 2023 | mariadb118 +15 | 3:11.8.9-1.amzn2023.0.1 | ALAS2023-2026-3310, ALAS2023-2026-3200 |
| Amazon Linux 2023 | mariadb123 +15 | 3:12.3.3-2.amzn2023.0.1 | ALAS2023-2026-3311, ALAS2023-2026-3201 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | mysql8.4 +7 | 8.4.11-1.el10_2 | ELSA-2026-56007 |
| Oracle Linux 9 | mecab +1 | 0.996-3.module+el9.8.0+90998+76ddfd45.4 | ELSA-2026-56973 |
| Oracle Linux 9 | mecab-ipadic +1 | 2.7.0.20070801-24.0.1.module+el9.8.0+90998+76ddfd45 | ELSA-2026-56973 |
| Oracle Linux 9 | mysql +7 | 8.4.11-1.module+el9.8.0+90998+76ddfd45 | ELSA-2026-56973 |
| Oracle Linux 9 | perl-DBD-MySQL | 4.053-3.module+el9.8.0+90998+76ddfd45 | ELSA-2026-56973 |
| Oracle Linux 9 | rapidjson-doc +1 | 1.1.0-19.module+el9.8.0+90998+76ddfd45 | ELSA-2026-56973 |
| Oracle Linux 8 | mecab +1 | 0.996-2.module+el8.10.0+90700+dfc34c39 | ELSA-2026-56936 |
| Oracle Linux 8 | mecab-ipadic +1 | 2.7.0.20070801-17.0.1.module+el8.10.0+90700+dfc34c39 | ELSA-2026-56936 |
| Oracle Linux 8 | mysql +7 | 8.4.11-1.module+el8.10.0+90997+4ac89c8b | ELSA-2026-56936 |
Advisories 24
- WID-SEC-2026-2441 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2026:56973 Important: mysql:8.4 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:56007 Important: mysql8.4 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:56936 Important: mysql:8.4 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3308 Important: mariadb1011 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 28, 2026
- ALAS2023-2026-3309 Important: mariadb114 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 28, 2026
- ALAS2023-2026-3310 Important: mariadb118 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 28, 2026
- ALAS2023-2026-3311 Important: mariadb123 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 28, 2026
- openSUSE-SU-2026:12245-1 libmariadbd-devel-12.3.2-3.1 on GA media SUSE / openSUSE Security Updates · Oct 24, 2026
- ALAS2023-2026-3200 Moderate: mariadb118 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3201 Moderate: mariadb123 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3198 Moderate: mariadb1011 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3199 Moderate: mariadb114 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- USN-8700-1 mysql-8.0, mysql-8.4 vulnerabilities Ubuntu Security Notices (USN) · Aug 31, 2026
- RLSA-2026:56007 Important: mysql8.4 security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 20, 2026
- RHSA-2026:56973 Red Hat Security Advisory: mysql:8.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2026:56936 Red Hat Security Advisory: mysql:8.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2026:56007 Red Hat Security Advisory: mysql8.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RLSA-2026:56973 Important: mysql:8.4 security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 20, 2026
- ELSA-2026-56936 Important: mysql:8.4 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 20, 2026
- ELSA-2026-56973 Important: mysql:8.4 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 20, 2026
- RLSA-2026:56936 Important: mysql:8.4 security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 19, 2026
- ELSA-2026-56007 Important: mysql8.4 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- NCSC-2026-0262 Kwetsbaarheden verholpen in Oracle MySQL Server en MySQL Cluster NCSC-NL (Netherlands) · Jul 22, 2026
References
- Oracle Advisory vendor-advisory