RHSA-2026:99720: Important: mysql8.4 security update

Published Nov 12, 2026
·
Updated

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.Security Fix(es): mysql: mysql: system takeover via mysqldump component (CVE-2026-101797) mysql: mysql: unauthorized server takeover (CVE-2026-101772) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101724) mysql: mysql: Denial of Service via client programs (CVE-2026-101754) mysql: mysql: System takeover via client programs (CVE-2026-101770) mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101732) mysql: mysql: Denial of Service via server optimizer flaw (CVE-2026-101623) mysql: mysql: Denial of Service via the Replication component (CVE-2026-101727) mysql: mysql: Denial of Service via the audit component (CVE-2026-101748) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101747) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101617) mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607) mysql: mysql: Complete server takeover via replication component (CVE-2026-101796) mysql: mysql: Denial of Service (CVE-2026-101778) mysql: MySQL Server: Denial of service in the Server Optimizer (CVE-2026-101731) mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776) mysql: mysql: Denial of service in InnoDB (CVE-2026-101609) mysql: mysql: Denial of service in InnoDB (CVE-2026-101760) mysql: mysql: unauthorized data modification via replication component (CVE-2026-101775) mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101610) mysql: mysql: Denial of Service via the C API (CVE-2026-101726) mysql: mysql: unauthorized data modification via XML component (CVE-2026-101803) mysql: mysql: Denial of Service in Group Replication (CVE-2026-101751) mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101619) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101622) mysql: mysql: Denial of Service via the Optimizer component (CVE-2026-101789) mysql: mysql: Denial of service in replication component (CVE-2026-101766) mysql: mysql: Denial of Service in Clone Plugin (CVE-2026-101750) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101618) mysql: mysql: Denial of Service via the Server Replication component (CVE-2026-101729) mysql: MySQL: Denial of Service via the Group Replication plugin (CVE-2026-101773) mysql: mysql: Denial of Service via security encryption component (CVE-2026-101762) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101611) mysql: mysql: unauthorized data access via improper privilege controls (CVE-2026-101800) mysql: mysql: Partial Denial of Service via Telemetry component (CVE-2026-101779) mysql: mysql: Denial of Service via Group Replication GCS (CVE-2026-101799) mysql: mysql: Denial of service in InnoDB (CVE-2026-101615) mysql: mysql: Denial of Service via the Server Parser (CVE-2026-101802) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101627) mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101730) mysql: mysql: Denial of Service via JSON component (CVE-2026-101733) mysql: mysql: Denial of Service via the C API component (CVE-2026-101725) mysql: mysql: Denial of Service via security encryption component (CVE-2026-101761) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101621) mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101608) mysql: mysql: Denial of Service in Server Components Services (CVE-2026-101721) mysql: mysql: Denial of service via DDL component (CVE-2026-101613) mysql: mysql: Denial of Service via multiple protocols (CVE-2026-101679) mysql: mysql: Denial of Service via X Plugin (CVE-2026-101780) mysql: mysql: Denial of Service via Server Components Services (CVE-2026-101788) mysql: mysql: Denial of Service via XML component flaw (CVE-2026-101794) mysql: mysql: Denial of Service in Pluggable Auth (CVE-2026-101728) mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101801) mysql: MySQL: Denial of Service via JSON component (CVE-2026-101616) mysql: mysql: complete service takeover via network access (CVE-2026-101771) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101614) mysql: mysql: Complete service compromise by a local privileged attacker (CVE-2026-101795) mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781) mysql: mysql: Denial of Service in the server optimizer (CVE-2026-101798) mysql: mysql: Denial of service via InnoDB storage engine (CVE-2026-101624) mysql: mysql: Denial of service via Pluggable Authentication component (CVE-2026-101774) mysql: MySQL: Unauthorized data modification in JSON component (CVE-2026-101785) mysql: mysql: Denial of service in query optimizer (CVE-2026-101784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

47 affected componentsFixes available
redhat/mysql8.4<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-common<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-debugsource<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-devel-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-errmsg<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-libs<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-libs-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-server<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-server-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-debugsource<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-devel-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-libs<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-libs-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-server<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-server-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-debugsource<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-devel-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-libs<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-libs-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-server<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-server-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test-debuginfo<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-debuginfo<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-debugsource<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-devel-debuginfo<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-libs<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-libs-debuginfo<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-server<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-server-debuginfo<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-test-debuginfo<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-devel<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test-data<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-devel<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-devel<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-test<8.4.13-1.el10_3.aa
8.4.13-1.el10_3.aa
redhat/mysql8.4-devel<8.4.13-1.el10_3
8.4.13-1.el10_3
redhat/mysql8.4-test<8.4.13-1.el10_3
8.4.13-1.el10_3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/mysql8.4 to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  2. Upgrade

    Upgrade redhat/mysql8.4-common to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  3. Upgrade

    Upgrade redhat/mysql8.4-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  4. Upgrade

    Upgrade redhat/mysql8.4-debugsource to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  5. Upgrade

    Upgrade redhat/mysql8.4-devel-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  6. Upgrade

    Upgrade redhat/mysql8.4-errmsg to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  7. Upgrade

    Upgrade redhat/mysql8.4-libs to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  8. Upgrade

    Upgrade redhat/mysql8.4-libs-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  9. Upgrade

    Upgrade redhat/mysql8.4-server to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  10. Upgrade

    Upgrade redhat/mysql8.4-server-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  11. Upgrade

    Upgrade redhat/mysql8.4-test-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  12. Upgrade

    Upgrade redhat/mysql8.4 to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  13. Upgrade

    Upgrade redhat/mysql8.4-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  14. Upgrade

    Upgrade redhat/mysql8.4-debugsource to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  15. Upgrade

    Upgrade redhat/mysql8.4-devel-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  16. Upgrade

    Upgrade redhat/mysql8.4-libs to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  17. Upgrade

    Upgrade redhat/mysql8.4-libs-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  18. Upgrade

    Upgrade redhat/mysql8.4-server to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  19. Upgrade

    Upgrade redhat/mysql8.4-server-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  20. Upgrade

    Upgrade redhat/mysql8.4-test-debuginfo to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  21. Upgrade

    Upgrade redhat/mysql8.4-devel to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  22. Upgrade

    Upgrade redhat/mysql8.4-test to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  23. Upgrade

    Upgrade redhat/mysql8.4-test-data to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3
  24. Upgrade

    Upgrade redhat/mysql8.4-devel to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa
  25. Upgrade

    Upgrade redhat/mysql8.4-test to a version that resolves this vulnerability.

    Fixed in 8.4.13-1.el10_3.aa

Event History

Nov 12, 2026
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

Do installations without the MySQL server package still need to be reviewed?

Yes. The update covers the mysql8.4 base package and mysql8.4-libs in addition to mysql8.4-server. The listed fixes include issues in client programs and mysqldump, so client-side package installations are also in scope.

2

Are development and debugging package installations covered by this update?

Yes. The affected software list includes mysql8.4-debuginfo, mysql8.4-debugsource, mysql8.4-devel-debuginfo, mysql8.4-libs-debuginfo, and mysql8.4-server-debuginfo.

3

Which deployments warrant the highest triage priority?

Prioritize systems running MySQL server functionality, replication, audit features, InnoDB workloads, or mysqldump and other client programs. The listed fixes include system or complete server takeover issues as well as multiple denial-of-service issues in those components.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203